Skip to content

Buffer overflow due to UB #28

@Jardynq

Description

@Jardynq

In Interleaf::ReadChunk on line 145, 147 and 156 respectively, it casts an integer to a string. This works most of the time, but is UB. If the int doesn't contain a null byte, then it reads into junk data.

E.g. take line 145 as an example:

desc << ((const char *) &rand_val);

It seems unintended? Wouldn't the following be what is intended?

desc << rand_val;

Otherwise this does the same, just safer:

int len = strnlen((*const char)&rand_val, sizeof(rand_val));
desc << std::string(rand_val, len);

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions