Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A risk of writing to an invalid address with memcpy in function Parser_feed #183

Open
awen-li opened this issue May 27, 2021 · 1 comment

Comments

@awen-li
Copy link

awen-li commented May 27, 2021

Code snippet

Parser_feed(Parser* self, PyObject *args)
{
     ........
     if((size_t)data_len > self->buffer_capacity - (self->buffer_end - self->buffer_start)) {
            self->buffer_capacity = MAX(self->buffer_capacity * 2, self->buffer_end - self->buffer_start + data_len);
            if(self->buffer == self->inline_buffer) {
                   self->buffer = malloc(self->buffer_capacity);    --------> may return a NULL pointer
                   memcpy(self->buffer + self->buffer_start, self->inline_buffer + self->buffer_start,
                                  self->buffer_end - self->buffer_start);
    } 
    ........
}

Description

Function: Parser_feed
File: cparser.c
Call-path: feed (Python) -> Parser_feed -> memcpy
WarningType: Invalid write. Our analysis tool reported a warning on potential write at an invalid address. As the buffer_capacity may depend on external inputs, hence it is possible that malloc-fail happens. Return value validation is necessary at this point.
Also seen in Details

@awen-li
Copy link
Author

awen-li commented May 31, 2021

Anyone can help confirm this issue? thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant