awakesecurity / gRPC-haskell

Haskell gRPC support
https://hackage.haskell.org/package/grpc-haskell
Apache License 2.0
238 stars 75 forks source link

Add 1 to malloc'd buffer size for null terminator #128

Closed Friede80 closed 3 years ago

Friede80 commented 3 years ago

strlen returns the index of the null terminator of the string, so mallocing that many bytes will be 1 less than needed to copy the string. The subsequent strcpy will overflow the buffer when copying the null terminator.

Unfortunately, I am still unable to run the package test suite to truly verify this change, but it does now compile for me without the nebulous gcc warnings.

evanrelf commented 3 years ago

I built grpc-haskell-core with -fsanitize=address and -fsanitize=undefined passed to gcc, before and after applying the fix, and the sanitizer output confirms that a buffer overflow was fixed 🎉

(Though the tests still fail with the fix applied and the sanitizers enabled, due to memory leaks we haven't fixed... 🙃)