search

bl4ck5un / Town-Crier

Town Crier: an Authenticated Data Feeds for Smart Contracts
https://town-crier.netlify.app/
Other
133 stars 25 forks source link

[security] Without verifying whether malloc is successful, copy the enclave buf outside directly #72

Open jmp0x7c00 opened 1 year ago

jmp0x7c00 commented 1 year ago

same to #70 https://github.com/bl4ck5un/Town-Crier/blob/78e19969dddf0964da9db1e9d1043e62f231daea/src/Enclave/scrapers/steam2.cpp#L223 *resp may be NULL

here is a memory copy, the content of query1 can be leaked outside enclave. https://github.com/bl4ck5un/Town-Crier/blob/78e19969dddf0964da9db1e9d1043e62f231daea/src/Enclave/scrapers/steam2.cpp#L224

same issue: https://github.com/bl4ck5un/Town-Crier/blob/78e19969dddf0964da9db1e9d1043e62f231daea/src/Enclave/test/regex_test.cpp#L80 https://github.com/bl4ck5un/Town-Crier/blob/78e19969dddf0964da9db1e9d1043e62f231daea/src/Enclave/test/regex_test.cpp#L81