Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MD_ReconstructionFromNode returns pointers to local variables #18

Open
mmozeiko opened this issue Jun 27, 2023 · 0 comments
Open

MD_ReconstructionFromNode returns pointers to local variables #18

mmozeiko opened this issue Jun 27, 2023 · 0 comments

Comments

@mmozeiko
Copy link
Contributor

MD_ReconstructionFromNode in out list returns pointers to local variables:
https://github.com/Dion-Systems/metadesk/blob/23289461d249c787ff631ba1f82535b20acefe68/source/md.c#L4137 and
https://github.com/Dion-Systems/metadesk/blob/23289461d249c787ff631ba1f82535b20acefe68/source/md.c#L4170

This means that anybody using list outside will potentially read garbage values. This happens in sanity_tests.c tests when it tries to join strings immediately afterwards (but in current code it will return correct strings because stack values are not yet overwritten):

https://github.com/Dion-Systems/metadesk/blob/23289461d249c787ff631ba1f82535b20acefe68/tests/sanity_tests.c#L846

If you want to trigger this error, then inserting following piece of code after line 845 (directly below call to MD_ReconstructionFromNode) will produce corrupted string and test will fail:

            {
                // overwrite 4KB of stack with 0xaa 
                char* stack = (char*)_alloca(4096);
                for (volatile int k = 0; k < 4096; k++) stack[k] = 0xaa;
            }

I have potential fix for this here: mmozeiko@a18850f
It changes char variables to string literals. If you're ok with such change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant