Skip to content

Offset Bound Check - #472

Closed
keerthimuvva52 wants to merge 1 commit into
masterfrom
offset_fix
Closed

Offset Bound Check#472
keerthimuvva52 wants to merge 1 commit into
masterfrom
offset_fix

Conversation

@keerthimuvva52

Copy link
Copy Markdown

No description provided.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds additional offset validation for Tamarama subengine data during RoseEngine database deserialization to prevent out-of-bounds reads (CWE-125).

Changes:

  • Introduces db_validate_tamarama_offsets() to validate Tamarama subengine offset tables and child NFA bounds.
  • Hooks Tamarama validation into db_validate_rose_offsets() so corrupted databases are rejected earlier.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/database.c
Comment on lines +290 to +293
for (u32 qi = 0; qi < rose->queueCount; qi++) {
if (unlikely((const char *)(&infos[qi + 1]) > rose_base + rose_size)) {
return HS_INVALID;
}
Comment thread src/database.c
Comment on lines +300 to +302
if (unlikely(ni->nfaOffset + sizeof(struct NFA) > rose_size)) {
return HS_INVALID;
}
Comment thread src/database.c
Comment on lines +311 to +313
if (unlikely(ni->nfaOffset + nfa->length > rose_size)) {
return HS_INVALID;
}
Comment thread src/database.c
Comment on lines +354 to +359
if (unlikely(child_off >= tama_len ||
child_off + sizeof(struct NFA) > tama_len)) {
DEBUG_PRINTF("Tamarama[%u] sub[%u] offset %u out of bounds "
"(tama_len=%u)\n", qi, i, child_off, tama_len);
return HS_INVALID;
}
Comment thread src/database.c
Comment on lines +364 to +368
if (unlikely(child_off + child->length > tama_len)) {
DEBUG_PRINTF("Tamarama[%u] sub[%u] child body overflows\n",
qi, i);
return HS_INVALID;
}
Comment thread src/database.c
return HS_INVALID;
}

const struct Tamarama *t = (const struct Tamarama *)tama_base;
Comment thread src/database.c
Comment on lines +346 to +349
/* subOffsets array starts after baseTops */
const u32 *subOffsets =
(const u32 *)(tama_base + sizeof(struct Tamarama) +
numSub * sizeof(u32));
Comment thread src/database.c
Comment on lines +282 to +284
if (!rose->nfaInfoOffset || rose->nfaInfoOffset >= rose_size) {
return HS_SUCCESS; /* no NFA engines - nothing to check */
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants