Skip to content
Snippets Groups Projects
Select Git revision
  • dualcore
  • ch3/leds
  • wip-bootstrap default
  • ch3/time
  • master
5 results

modstruct.c

Blame
    • Damien George's avatar
      2daacc5c
      py/modstruct: Check and prevent buffer-write overflow in struct packing. · 2daacc5c
      Damien George authored
      Prior to this patch, the size of the buffer given to pack_into() was checked
      for being too small by using the count of the arguments, not their actual
      size.  For example, a format spec of '4I' would only check that there was 4
      bytes available, not 16; and 'I' would check for 1 byte, not 4.
      
      The pack() function is ok because its buffer is created to be exactly the
      correct size.
      
      The fix in this patch calculates the total size of the format spec at the
      start of pack_into() and verifies that the buffer is large enough.  This
      adds some computational overhead, to iterate through the whole format spec.
      The alternative is to check during the packing, but that requires extra
      code to handle alignment, and the check is anyway not needed for pack().
      So to maintain minimal code size the check is done using struct_calcsize.
      2daacc5c
      History
      py/modstruct: Check and prevent buffer-write overflow in struct packing.
      Damien George authored
      Prior to this patch, the size of the buffer given to pack_into() was checked
      for being too small by using the count of the arguments, not their actual
      size.  For example, a format spec of '4I' would only check that there was 4
      bytes available, not 16; and 'I' would check for 1 byte, not 4.
      
      The pack() function is ok because its buffer is created to be exactly the
      correct size.
      
      The fix in this patch calculates the total size of the format spec at the
      start of pack_into() and verifies that the buffer is large enough.  This
      adds some computational overhead, to iterate through the whole format spec.
      The alternative is to check during the packing, but that requires extra
      code to handle alignment, and the check is anyway not needed for pack().
      So to maintain minimal code size the check is done using struct_calcsize.