Skip to content

Hardening: add null guards and bounds checks to string, array, and table setters - #9385

Closed
anagnorisis2peripeteia wants to merge 1 commit into
google:masterfrom
anagnorisis2peripeteia:fix-table-struct-string-and-array-safety
Closed

anagnorisis2peripeteia wants to merge 1 commit into
google:masterfrom
anagnorisis2peripeteia:fix-table-struct-string-and-array-safety

Conversation

@anagnorisis2peripeteia

Copy link
Copy Markdown

Summary

  • Defensive hardening in include/flatbuffers/string.h, include/flatbuffers/array.h, and include/flatbuffers/table.h.
  • In include/flatbuffers/string.h:
    • Return empty string literals when Data() is null in c_str().
    • Guard std::string and string_view construction against null buffers and zero size.
    • Guard operator< against null string buffers.
  • In include/flatbuffers/array.h:
    • Guard Get() and GetMutablePointer() with out-of-bounds checks and null buffer guards.
    • In CopyFromSpan(): guard against null span and null destination data, and scale overlap check by sizeof(T).
    • In MutateImpl(): guard against out-of-bounds indices and null buffers.
  • In include/flatbuffers/table.h:
    • In SetPointer(): guard against null pointer arguments and validate that pointer offset is non-negative (val >= data_ + field_offset).
  • Add tests in tests/test.cpp covering all hardened paths.

@anagnorisis2peripeteia

Copy link
Copy Markdown
Author

Closing this pull request.

These checks sit in accessors or helpers that run after verification. FlatBuffers checks an untrusted buffer in the verifier, once. A caller mistake is FLATBUFFERS_ASSERT. Returning 0, nullptr, false, or an empty value hides the mistake and changes behavior for a valid buffer.

See the C++ guide section "Access of untrusted buffers" and the review on #8990.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant