RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 21:17:44 +00:00
Code Issues Activity Actions

LibCore: Avoid logical OOB read in AllocatingMemoryStream::offset_of()

Browse source 
The previous impl was trimming the last chunk to the free space instead
of the used space, which yielded an OOB read if the needle wasn't found.
This commit is contained in:
Ali Mohammad Pur 2023-01-20 21:00:40 +03:30 • committed by Linus Groh
parent c8e25a71e0
commit 7d4a30af56
2 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Userland/Libraries/LibCore/MemoryStream.cpp
View file

@ -219,7 +219,7 @@ ErrorOr<Optional<size_t>> AllocatingMemoryStream::offset_of(ReadonlyBytes needle
}
// Trimming is done first to ensure that we don't unintentionally shift around if the first and last chunks are the same.
search_spans[chunk_count - 1] = search_spans[chunk_count - 1].trim(chunk_count * chunk_size - m_write_offset);
search_spans[chunk_count - 1] = search_spans[chunk_count - 1].trim(m_write_offset % chunk_size);
search_spans[0] = search_spans[0].slice(m_read_offset);
return AK::memmem(search_spans.begin(), search_spans.end(), needle);