From 4f07c29685d0ef8562152b48ba4d24d6ff5820e2 Mon Sep 17 00:00:00 2001 From: Aysha Afrah Ziya Date: Tue, 7 Jul 2026 19:30:48 +0530 Subject: [PATCH] fix out-of-bounds read in isBlackboardPointer whitespace trim --- src/tree_node.cpp | 4 ++-- tests/gtest_ports.cpp | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/tree_node.cpp b/src/tree_node.cpp index 0a24dd606..e43f19706 100644 --- a/src/tree_node.cpp +++ b/src/tree_node.cpp @@ -396,11 +396,11 @@ bool TreeNode::isBlackboardPointer(StringView str, StringView* stripped_pointer) // strip leading and following spaces size_t front_index = 0; size_t last_index = str.size() - 1; - while(str[front_index] == ' ' && front_index <= last_index) + while(front_index <= last_index && str[front_index] == ' ') { front_index++; } - while(str[last_index] == ' ' && front_index <= last_index) + while(front_index <= last_index && str[last_index] == ' ') { last_index--; } diff --git a/tests/gtest_ports.cpp b/tests/gtest_ports.cpp index e9ab1fb73..a9918cde8 100644 --- a/tests/gtest_ports.cpp +++ b/tests/gtest_ports.cpp @@ -869,3 +869,21 @@ TEST(PortTest, SubtreeStringLiteralToLoopDouble_Issue1065) EXPECT_DOUBLE_EQ(collected[1], 2.0); EXPECT_DOUBLE_EQ(collected[2], 3.0); } + +TEST(PortTest, IsBlackboardPointerAllWhitespaceView) +{ + // A view made only of spaces must not be read past its end while trimming. + // Use a buffer that is not null-terminated so AddressSanitizer catches the + // over-read on the character after the last space. + std::vector only_spaces(3, ' '); + const StringView spaces_view(only_spaces.data(), only_spaces.size()); + EXPECT_FALSE(TreeNode::isBlackboardPointer(spaces_view)); + + // Trimming and detection of real pointers is unchanged. + StringView stripped; + EXPECT_TRUE(TreeNode::isBlackboardPointer("{key}", &stripped)); + EXPECT_EQ(stripped, "key"); + EXPECT_TRUE(TreeNode::isBlackboardPointer(" {key} ", &stripped)); + EXPECT_EQ(stripped, "key"); + EXPECT_FALSE(TreeNode::isBlackboardPointer("value")); +}