gabime / spdlog

Fast C++ logging library.
Other
24.3k stars 4.54k forks source link

Vulnerability detected by security scan in core.h #2698

Closed eugrin closed 1 year ago

eugrin commented 1 year ago

cpp/enum-index (in thirdparty/spdlog/include/spdlog/fmt/bundled/core.h

When accessing array values with index id, the upper bound of an enum is used to check the upper bound of the array, but the lower bound is not checked. 2029 arg.type = type(id); 2030 if (arg.type_ == detail::type::nonetype) return arg; 2031 arg.value = values_[id]; 2032 return arg; 2033 }

tt4g commented 1 year ago

Please reoepn issue in fmt project, because include/spdlog/fmt/bundled/core.h is fmt library source.

tt4g commented 1 year ago

Closed in fmt project: fmtlib/fmt#3371