Open Crispy-fried-chicken opened 3 months ago
Hi,
from your point of view, what is the issue (i.e. what are you going to fix with a PR)?
@alexey-tikhonov Hi, maybe I'm going to fix it by using pointer-based iteration just like the fix in https://github.com/mongodb/mongo-c-driver/commit/effd95c34ad421df94eec7c69236f0e4172552d0. It may avoid overflow.
Well, the question was "what" is the issue, not "how" to fix it.
I don't think overflow of i
in free_args()
is a "valid" issue: args
are allocated using realloc(ret, (num + 2) * sizeof(char *));
where num
is int. So if overflow could happen, it would happen before.
In this sense change of iterator from int to pointer is quite cosmetic but it won't hurt either.
I know, but if the num
is INT_MAX-2
, there is no possibility that the overflow will happen? and there is no need to fix it?
I know, but if the
num
isINT_MAX-2
, there is no possibility that the overflow will happen? and there is no need to fix it?
Sorry I didn't understand this question.
I mean there is no need that num
is INT_MAX-2
?If so, it will be overflow.
Hi, we have detected that your project may be vulnerable to Integer Overflow to Buffer Overflow in the function of
free_args
in the file ofsrc/util/util.c
. It shares similarities to a recent CVE disclosure CVE-2024-6381 in the mongo-c-driver.The source vulnerability information is as follows:
Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!