Skip to content

Commit

Permalink
Use buffer size in LenVal::GetDataSize
Browse files Browse the repository at this point in the history
If `TransferFromSandboxee` fails, the size saved in struct might not correspond to size of buffer, possibly leading to OOB reads/writes in user code.

PiperOrigin-RevId: 623106099
Change-Id: I61b070bba5fc81b13558d0c415a08cd4ee95c685
  • Loading branch information
happyCoder92 authored and copybara-github committed Apr 9, 2024
1 parent aa6ed45 commit 0b1b48c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion sandboxed_api/var_lenval.h
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ class LenVal : public Var {
std::string ToString() const final { return "LenVal"; }

absl::Status ResizeData(RPCChannel* rpc_channel, size_t size);
size_t GetDataSize() const { return struct_.data().size; }
size_t GetDataSize() const { return array_.GetSize(); }
uint8_t* GetData() const { return array_.GetData(); }
void* GetRemote() const final { return struct_.GetRemote(); }

Expand Down

0 comments on commit 0b1b48c

Please sign in to comment.