Skip to content

fix CLStream memcpy read 1 extra byte - #240

Merged
xiaokang merged 2 commits into
apache:clucenefrom
xiaokang:fix-clucene-memcpy
Sep 16, 2024
Merged

fix CLStream memcpy read 1 extra byte#240
xiaokang merged 2 commits into
apache:clucenefrom
xiaokang:fix-clucene-memcpy

Conversation

@xiaokang

@xiaokangxiaokang commented Sep 15, 2024

Copy link
Copy Markdown

It should only copy the length passed from argument, instead of length + 1, which may cause ASAN global-buffer-overflow.

 void init(const void *_value, int32_t _length, bool copyData = true) override {
const size_t length = _length;
this->pos = 0;
if (copyData) {
T *tmp = (T *) this->value;
if (tmp == NULL || !this->ownValue) {
tmp = _CL_NEWARRAY(T, length + 1);
this->buffer_size = length;
} else if (length > this->buffer_size || length < (this->buffer_size / 2)) {//expand, or shrink
tmp = (T *) realloc(tmp, sizeof(T) * (length + 1));
this->buffer_size = length;
}
memcpy(tmp, _value, length + 1); ///////////////// THIS IS THE BUGGY LINE //////////
this->value = tmp;
} else {
if (ownValue && this->value != NULL) {
_CLDELETE_LARRAY((T *) this->value);
}
this->value = (T *)_value;
this->buffer_size = 0;
}
this->m_size = length;
this->ownValue = copyData;
};

Comment threadsrc/core/CLucene/util/CLStreams.h Outdated
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@xiaokang@airborne12