Skip to content

fix out-of-bounds read in isBlackboardPointer whitespace trim#1161

Open
aysha-afrah26 wants to merge 1 commit into
BehaviorTree:masterfrom
aysha-afrah26:blackboard-pointer-oob-trim
Open

fix out-of-bounds read in isBlackboardPointer whitespace trim#1161
aysha-afrah26 wants to merge 1 commit into
BehaviorTree:masterfrom
aysha-afrah26:blackboard-pointer-oob-trim

Conversation

@aysha-afrah26

Copy link
Copy Markdown

isBlackboardPointer trims leading and trailing spaces with two while loops before it checks for the {...} pattern, and each loop tests the character before it tests the index against the bounds. Because of the short-circuit order, str[front_index] is read first and front_index <= last_index only after. When the whole value is spaces, front_index walks up to str.size() and the loop reads one element past the end before the bounds check would have stopped it. The argument is a std::string_view, so that trailing byte is not guaranteed to be there; I ran into it under AddressSanitizer, which reports a heap-buffer-overflow read on a non null-terminated view of three spaces. Swapping the two operands so the bounds check runs first closes the read and leaves the trimming behavior unchanged. I added a regression test in gtest_ports that fails under ASan before the change and passes after.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant