Commit 97e1a10
committed
midb_agent: reduce stack usage / resolve OOB write
4. tainted_data_return: Called function read(pback->sockd, buff +
offset, 262144 - offset), and a possible return value may be less
than zero.
5. cast_overflow: An assign that casts to a different type, which
might trigger an overflow.
CID 1589501: (#1 of 1): Overflowed array index write (INTEGER_OVERFLOW) [enum_subscriptions]
CID 1589502: (#1 of 1): Overflowed array index write (INTEGER_OVERFLOW) [enum_folders]
CID 1589506: (#1 of 1): Overflowed array index write (INTEGER_OVERFLOW) [fetch_detail_uid]
CID 1589510: (#1 of 1): Overflowed array index write (INTEGER_OVERFLOW) [list_deleted]
CID 1589520: (#1 of 1): Overflowed array index write (INTEGER_OVERFLOW) [fetch_simple_uid]
CID 1589522: (#1 of 1): Overflowed array index write (INTEGER_OVERFLOW) [list_mail]
8. deref_overflow: offset, which might have overflowed, is used in a
pointer index in buff[offset].
Basically, if ``read()`` fills the complete buffer (256K), then
buff[offset]='\0' will write to one past the last. Switching to
std::string helps get rid of the huge stack variable as well as
getting a safe guaranteed terminator.1 parent 79dd170 commit 97e1a10
2 files changed
+77
-66
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
126 | 126 | | |
127 | 127 | | |
128 | 128 | | |
129 | | - | |
| 129 | + | |
130 | 130 | | |
131 | 131 | | |
132 | 132 | | |
| |||
0 commit comments