RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 13:37:44 +00:00
Code Issues Activity Actions

AK: Fix OOB access in DuplexMemoryStream::offset_of()

Browse source 
This fixes an OOB access when the last read/written chunk is empty (as we _just_
started on a new chunk).
Also adds a test case to TestMemoryStream.
Found via human fuzzing in the shell:
```sh
for $(cat /dev/urandom) {
    clear
    match $it {
        ?* as (x) {
            echo $x
            sleep 1
        }
    }
}
```
would assert at some point.
This commit is contained in:
AnotherTest 2020-11-16 20:54:49 +03:30 • committed by Andreas Kling
parent b1fb8e3741
commit 4c343c5f26
2 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
AK/MemoryStream.h
View file

@ -221,22 +221,26 @@ public:
return true;
}
// FIXME: Does not read across chunk boundaries
// Perhaps implement AK::memmem() for iterators?
Optional<size_t> offset_of(ReadonlyBytes value) const
{
if (value.size() > size())
return {};
// First, find which chunk we're in.
auto chunk_index = (m_read_offset - m_base_offset) / chunk_size;
auto chunk_index = min((m_read_offset - m_base_offset) / chunk_size, m_chunks.size() - 1);
auto last_written_chunk_index = (m_write_offset - m_base_offset) / chunk_size;
auto first_chunk_index = chunk_index;
auto last_written_chunk_offset = m_write_offset % chunk_size;
auto first_chunk_offset = m_read_offset % chunk_size;
size_t last_chunk_offset = 0;
auto found_value = false;
auto chunk_index_max_bound = last_written_chunk_offset > 0 ? last_written_chunk_index + 1 : last_written_chunk_index;
for (; chunk_index <= last_written_chunk_index; ++chunk_index) {
auto chunk_bytes = m_chunks[chunk_index].bytes();
for (; chunk_index < chunk_index_max_bound; ++chunk_index) {
auto& chunk = m_chunks[chunk_index];
auto chunk_bytes = chunk.bytes();
size_t chunk_offset = 0;
if (chunk_index == last_written_chunk_index) {
chunk_bytes = chunk_bytes.slice(0, last_written_chunk_offset);