Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix out-of-bounds writesin BitView::_Read64<true> #355

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from

Conversation

chiayy-com
Copy link

This fixes #354.

@wallentx wallentx requested a review from harold-b July 24, 2023 01:46
Copy link
Author

@chiayy-com chiayy-com left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Explanation:

The original implementation had 2 issues.
The isLastField (which should be name isIncompleteField) on Line 148 is calculated incorrectly. And - 1 is not needed. (As discussed in #355) This causes the first remainderBytes (Line 158) to potentially exceed 8 and results in an illegal write.
The other issue is that the second remainderBytes (Line 187) is calucated incorrectly. Because pField has advanced 8 bytes, remainderBytes should be 8 less than the previous remainderBytes.

The latest commit I rewrote the isLastField/remainderBytes logic, and now this approach is (I believe) easier to understand and less likely to make mistake.

@chiayy-com
Copy link
Author

Note:
I just noticed there's no test cases for this functionality in the codespace.
I did some regression testing manually (fetching proofs / quality) and it works fine, but it still need some serious tests.

(I‘d like to add some, but I'm not sure of when 😂)

@harold-b
Copy link
Contributor

Yes feel free to add a test. BB currently does not have much tests, there's a few for specific cases and commonly re-used objects. But it's mostly used as a sandbox.

You can have a look in Tests.cmake.

@harold-b harold-b changed the base branch from master to develop September 8, 2023 19:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug] Out-of-bounds writes in BitView::_Read64<true> potentially causing crashes or infinite loops
3 participants