Fix macOS segfault when a page does not exist - #127
Open
NNoradrenaline wants to merge 2 commits into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does it do?
Fixes an out-of-bounds write in
curl_string_init()that can crash the client when a requested page does not exist and the code falls back to the network path.The response buffer is now initialized with
str->str[0] = '\0';instead of writing one byte past the 1024-byte allocation.This also adds regression coverage for missing pages and a macOS AddressSanitizer CI job.
Why the change?
Issues #124 and #123 report crashes on macOS when requesting unknown or unavailable pages.
curl_string_init()allocates 1024 bytes, but previously wrotestr->str[1024] = '\0';.Valid indexes are
0through1023, so this write is out of bounds and can cause the reported crash.How can this be tested?
Build the client and run:
./tldr this-page-definitely-does-not-exist-124-regressionExpected behavior:
1.The added CI coverage also exercises this path under AddressSanitizer on macOS.
Where to start code review?
Start in
src/net.catcurl_string_init().The regression test and sanitizer configuration are in
.github/workflows/tests.yml.Relevant tickets?
Fixes #124
Related: #123
Questions?
None.