Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid reading 1 byte off the end when the string does not contain a '\0' byte #1888

Merged
merged 2 commits into from
Sep 2, 2021

Conversation

kevinbackhouse
Copy link
Collaborator

Fixes: #1887

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37889

These three loops were followed by a ++i operation, which worked correctly when the string contained a '\0' byte, but advanced i to one byte beyond the end of the buffer when it didn't.

@kevinbackhouse kevinbackhouse added bug OSS-Fuzz Bug reported by https://google.github.io/oss-fuzz/ labels Sep 1, 2021
@kevinbackhouse
Copy link
Collaborator Author

@Mergifyio backport 0.27-maintenance

@mergify
Copy link
Contributor

mergify bot commented Sep 1, 2021

Command backport 0.27-maintenance: pending

Waiting for the pull request to get merged

@codecov
Copy link

codecov bot commented Sep 1, 2021

Codecov Report

Merging #1888 (96516c8) into main (cb16324) will increase coverage by 0.00%.
The diff coverage is 100.00%.

❗ Current head 96516c8 differs from pull request most recent head bd211a9. Consider uploading reports for the commit bd211a9 to get more accurate results
Impacted file tree graph

@@           Coverage Diff           @@
##             main    #1888   +/-   ##
=======================================
  Coverage   60.80%   60.81%           
=======================================
  Files          96       96           
  Lines       18963    18960    -3     
  Branches     9512     9512           
=======================================
- Hits        11531    11530    -1     
+ Misses       5131     5130    -1     
+ Partials     2301     2300    -1     
Impacted Files Coverage Δ
src/crwimage_int.cpp 74.04% <100.00%> (+0.03%) ⬆️
src/crwimage.cpp 64.19% <0.00%> (+1.23%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update cb16324...bd211a9. Read the comment docs.

@kevinbackhouse kevinbackhouse added this to the v1.00 milestone Sep 2, 2021
…l?id=37889

Avoid reading 1 byte off the end when the string does not contain a '\0' byte.
Copy link
Collaborator

@kmilos kmilos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mergify
Copy link
Contributor

mergify bot commented Sep 2, 2021

Command backport 0.27-maintenance: success

Backports have been created

kevinbackhouse added a commit that referenced this pull request Sep 5, 2021
Avoid reading 1 byte off the end when the string does not contain a '\0' byte (backport #1888)
@kevinbackhouse kevinbackhouse deleted the FixIssue1887 branch September 7, 2021 09:41
@clanmills clanmills mentioned this pull request Oct 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug OSS-Fuzz Bug reported by https://google.github.io/oss-fuzz/
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Out-of-bounds read in CrwMap::decode0x080a
2 participants