Skip to content

Commit

Permalink
SCP: Add'l memory sanitization fixes
Browse files Browse the repository at this point in the history
Initialize de-dup'ed debug line buffer:

  realloc(NULL, size) == malloc(size), which results in an uninitialized
  debug line buffer and will fail memory sanitizer checks. Ensure that
  the buffers are memset() to zero when initially allocated.

Another Random Act of Memory (Sanitization):

  Clang's memory sanitizer found an off-by-one bug in sim_addr_acl_check
  while executing "testlib". This makes CIDR network ACLs functional,
  e.g., "127.0.0.1/32" is interpreted properly and the associated
  "testlib" test passes.
  • Loading branch information
bscottm committed Dec 4, 2023
1 parent 625b9e8 commit 59ba2d8
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 1 deletion.
9 changes: 9 additions & 0 deletions scp.c
Original file line number Diff line number Diff line change
Expand Up @@ -13622,9 +13622,18 @@ if (sim_deb_switches & SWMASK ('F')) { /* filtering disabled? */
}
AIO_LOCK;
if (debug_line_offset + len + 1 > debug_line_bufsize) {
/* realloc(NULL, size) == malloc(size). Really. It is. Initialize
* the malloc()-ed space. */
int do_init = (NULL == debug_line_buf) || (NULL == debug_line_buf_last);

debug_line_bufsize += MAX(1024, debug_line_offset + len + 1);
debug_line_buf = (char *)realloc (debug_line_buf, debug_line_bufsize);
debug_line_buf_last = (char *)realloc (debug_line_buf_last, debug_line_bufsize);

if (do_init) {
memset(debug_line_buf, 0, debug_line_bufsize);
memset(debug_line_buf_last, 0, debug_line_bufsize);
}
}
memcpy (&debug_line_buf[debug_line_offset], buf, len);
debug_line_buf[debug_line_offset + len] = '\0';
Expand Down
2 changes: 1 addition & 1 deletion sim_sock.c
Original file line number Diff line number Diff line change
Expand Up @@ -721,7 +721,7 @@ if (c != NULL) {
if ((c - validate_addr) > sizeof (v_cpy) - 1)
return status;
memcpy (v_cpy, validate_addr, c - validate_addr); /* Copy everything before the / */
v_cpy[1 + c - validate_addr] = '\0'; /* NUL terminate the result */
v_cpy[c - validate_addr] = '\0'; /* NUL terminate the result */
validate_addr = v_cpy; /* Use the original string minus the prefix specifier */
}
if (p_getaddrinfo(validate_addr, NULL, NULL, &ai_validate))
Expand Down

0 comments on commit 59ba2d8

Please sign in to comment.