Fix: Out-of-bounds write #541

New issue

Closed

opened 2023-05-09 15:19:42 -05:00 by Youw · 0 comments

Youw commented

2023-05-09 15:19:42 -05:00

(Migrated from github.com)

Found as part of: #63

static int parse_hid_vid_pid_from_uevent_path(const char *uevent_path, unsigned *bus_type, unsigned short *vendor_id, unsigned short *product_id)
446{
447        int handle;
448        ssize_t res;
449
450        handle = open(uevent_path, O_RDONLY | O_CLOEXEC);
   	1. Condition handle < 0, taking false branch.
451        if (handle < 0) {
452                register_global_error_format("open failed (%s): %s", uevent_path, strerror(errno));
453                return 0;
454        }
455
456        char buf[1024];
   	2. identity_transfer: Passing 1024UL as argument 3 to function read, which returns that argument.
   	3. assignment: Assigning: res = read(handle, buf, 1024UL). The value of res is now 1024.
457        res = read(handle, buf, sizeof(buf));
458        close(handle);
459
   	4. Condition res < 0, taking false branch.
460        if (res < 0) {
461                register_global_error_format("read failed (%s): %s", uevent_path, strerror(errno));
462                return 0;
463        }
464
   	
CID 1529210 (#1 of 1): Out-of-bounds write (OVERRUN)
5. overrun-local: Overrunning array buf of 1024 bytes at byte offset 1024 using index res (which evaluates to 1024).
465        buf[res] = '\0';
466        return parse_hid_vid_pid_from_uevent(buf, bus_type, vendor_id, product_id);
467}

Found as part of: #63 ``` static int parse_hid_vid_pid_from_uevent_path(const char *uevent_path, unsigned *bus_type, unsigned short *vendor_id, unsigned short *product_id) 446{ 447 int handle; 448 ssize_t res; 449 450 handle = open(uevent_path, O_RDONLY | O_CLOEXEC); 1. Condition handle < 0, taking false branch. 451 if (handle < 0) { 452 register_global_error_format("open failed (%s): %s", uevent_path, strerror(errno)); 453 return 0; 454 } 455 456 char buf[1024]; 2. identity_transfer: Passing 1024UL as argument 3 to function read, which returns that argument. 3. assignment: Assigning: res = read(handle, buf, 1024UL). The value of res is now 1024. 457 res = read(handle, buf, sizeof(buf)); 458 close(handle); 459 4. Condition res < 0, taking false branch. 460 if (res < 0) { 461 register_global_error_format("read failed (%s): %s", uevent_path, strerror(errno)); 462 return 0; 463 } 464 CID 1529210 (#1 of 1): Out-of-bounds write (OVERRUN) 5. overrun-local: Overrunning array buf of 1024 bytes at byte offset 1024 using index res (which evaluates to 1024). 465 buf[res] = '\0'; 466 return parse_hid_vid_pid_from_uevent(buf, bus_type, vendor_id, product_id); 467} ```