From 19470722b370f65596d2b0628e2a39fe494fb560 Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Thu, 4 Feb 2021 13:41:21 +0000 Subject: [PATCH] glib: Use g_memdup2() instead of g_memdup() in obvious places MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Convert all the call sites which use `g_memdup()`’s length argument trivially (for example, by passing a `sizeof()` or an existing `gsize` variable), so that they use `g_memdup2()` instead. In almost all of these cases the use of `g_memdup()` would not have caused problems, but it will soon be deprecated, so best port away from it In particular, this fixes an overflow within `g_bytes_new()`, identified as GHSL-2021-045 by GHSL team member Kevin Backhouse. Signed-off-by: Philip Withnall Fixes: GHSL-2021-045 Helps: #2319 --- glib/gbytes.c | 4 ++-- glib/gdir.c | 2 +- glib/ghash.c | 6 +++--- glib/giochannel.c | 4 ++-- glib/gslice.c | 2 +- glib/gtestutils.c | 2 +- glib/gvariant.c | 6 +++--- glib/gvarianttype.c | 2 +- glib/tests/array-test.c | 2 +- glib/tests/option-context.c | 4 ++-- glib/tests/uri.c | 6 +++--- 11 files changed, 20 insertions(+), 20 deletions(-) diff --git a/glib/gbytes.c b/glib/gbytes.c index ec6923188..00fd79155 100644 --- a/glib/gbytes.c +++ b/glib/gbytes.c @@ -95,7 +95,7 @@ g_bytes_new (gconstpointer data, { g_return_val_if_fail (data != NULL || size == 0, NULL); - return g_bytes_new_take (g_memdup (data, size), size); + return g_bytes_new_take (g_memdup2 (data, size), size); } /** @@ -499,7 +499,7 @@ g_bytes_unref_to_data (GBytes *bytes, * Copy: Non g_malloc (or compatible) allocator, or static memory, * so we have to copy, and then unref. */ - result = g_memdup (bytes->data, bytes->size); + result = g_memdup2 (bytes->data, bytes->size); *size = bytes->size; g_bytes_unref (bytes); } diff --git a/glib/gdir.c b/glib/gdir.c index 6b85e99c8..c26edc1dc 100644 --- a/glib/gdir.c +++ b/glib/gdir.c @@ -112,7 +112,7 @@ g_dir_open_with_errno (const gchar *path, return NULL; #endif - return g_memdup (&dir, sizeof dir); + return g_memdup2 (&dir, sizeof dir); } /** diff --git a/glib/ghash.c b/glib/ghash.c index f3ed0f3b9..cc2d00087 100644 --- a/glib/ghash.c +++ b/glib/ghash.c @@ -962,7 +962,7 @@ g_hash_table_ensure_keyval_fits (GHashTable *hash_table, gpointer key, gpointer if (hash_table->have_big_keys) { if (key != value) - hash_table->values = g_memdup (hash_table->keys, sizeof (gpointer) * hash_table->size); + hash_table->values = g_memdup2 (hash_table->keys, sizeof (gpointer) * hash_table->size); /* Keys and values are both big now, so no need for further checks */ return; } @@ -970,7 +970,7 @@ g_hash_table_ensure_keyval_fits (GHashTable *hash_table, gpointer key, gpointer { if (key != value) { - hash_table->values = g_memdup (hash_table->keys, sizeof (guint) * hash_table->size); + hash_table->values = g_memdup2 (hash_table->keys, sizeof (guint) * hash_table->size); is_a_set = FALSE; } } @@ -998,7 +998,7 @@ g_hash_table_ensure_keyval_fits (GHashTable *hash_table, gpointer key, gpointer /* Just split if necessary */ if (is_a_set && key != value) - hash_table->values = g_memdup (hash_table->keys, sizeof (gpointer) * hash_table->size); + hash_table->values = g_memdup2 (hash_table->keys, sizeof (gpointer) * hash_table->size); #endif } diff --git a/glib/giochannel.c b/glib/giochannel.c index d977b769e..63d7e0314 100644 --- a/glib/giochannel.c +++ b/glib/giochannel.c @@ -1673,10 +1673,10 @@ g_io_channel_read_line (GIOChannel *channel, /* Copy the read bytes (including any embedded nuls) and nul-terminate. * `USE_BUF (channel)->str` is guaranteed to be nul-terminated as it’s a - * #GString, so it’s safe to call g_memdup() with +1 length to allocate + * #GString, so it’s safe to call g_memdup2() with +1 length to allocate * a nul-terminator. */ g_assert (USE_BUF (channel)); - line = g_memdup (USE_BUF (channel)->str, got_length + 1); + line = g_memdup2 (USE_BUF (channel)->str, got_length + 1); line[got_length] = '\0'; *str_return = g_steal_pointer (&line); g_string_erase (USE_BUF (channel), 0, got_length); diff --git a/glib/gslice.c b/glib/gslice.c index 589619080..d6335c9dd 100644 --- a/glib/gslice.c +++ b/glib/gslice.c @@ -351,7 +351,7 @@ g_slice_get_config_state (GSliceConfig ckey, array[i++] = allocator->contention_counters[address]; array[i++] = allocator_get_magazine_threshold (allocator, address); *n_values = i; - return g_memdup (array, sizeof (array[0]) * *n_values); + return g_memdup2 (array, sizeof (array[0]) * *n_values); default: return NULL; } diff --git a/glib/gtestutils.c b/glib/gtestutils.c index 5660fc8be..d24c6e186 100644 --- a/glib/gtestutils.c +++ b/glib/gtestutils.c @@ -3966,7 +3966,7 @@ g_test_log_extract (GTestLogBuffer *tbuffer) if (p <= tbuffer->data->str + mlength) { g_string_erase (tbuffer->data, 0, mlength); - tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup (&msg, sizeof (msg))); + tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup2 (&msg, sizeof (msg))); return TRUE; } diff --git a/glib/gvariant.c b/glib/gvariant.c index 5584614c6..e48dec1ad 100644 --- a/glib/gvariant.c +++ b/glib/gvariant.c @@ -725,7 +725,7 @@ g_variant_new_variant (GVariant *value) g_variant_ref_sink (value); return g_variant_new_from_children (G_VARIANT_TYPE_VARIANT, - g_memdup (&value, sizeof value), + g_memdup2 (&value, sizeof value), 1, g_variant_is_trusted (value)); } @@ -1229,7 +1229,7 @@ g_variant_new_fixed_array (const GVariantType *element_type, return NULL; } - data = g_memdup (elements, n_elements * element_size); + data = g_memdup2 (elements, n_elements * element_size); value = g_variant_new_from_data (array_type, data, n_elements * element_size, FALSE, g_free, data); @@ -1912,7 +1912,7 @@ g_variant_dup_bytestring (GVariant *value, if (length) *length = size; - return g_memdup (original, size + 1); + return g_memdup2 (original, size + 1); } /** diff --git a/glib/gvarianttype.c b/glib/gvarianttype.c index 831fed4bf..cc97235f3 100644 --- a/glib/gvarianttype.c +++ b/glib/gvarianttype.c @@ -1181,7 +1181,7 @@ g_variant_type_new_tuple (const GVariantType * const *items, g_assert (offset < sizeof buffer); buffer[offset++] = ')'; - return (GVariantType *) g_memdup (buffer, offset); + return (GVariantType *) g_memdup2 (buffer, offset); } /** diff --git a/glib/tests/array-test.c b/glib/tests/array-test.c index adedfc19f..fef63f672 100644 --- a/glib/tests/array-test.c +++ b/glib/tests/array-test.c @@ -1933,7 +1933,7 @@ byte_array_new_take (void) GByteArray *gbarray; guint8 *data; - data = g_memdup ("woooweeewow", 11); + data = g_memdup2 ("woooweeewow", 11); gbarray = g_byte_array_new_take (data, 11); g_assert (gbarray->data == data); g_assert_cmpuint (gbarray->len, ==, 11); diff --git a/glib/tests/option-context.c b/glib/tests/option-context.c index ec66e6f94..042b130af 100644 --- a/glib/tests/option-context.c +++ b/glib/tests/option-context.c @@ -257,7 +257,7 @@ join_stringv (int argc, char **argv) static char ** copy_stringv (char **argv, int argc) { - return g_memdup (argv, sizeof (char *) * (argc + 1)); + return g_memdup2 (argv, sizeof (char *) * (argc + 1)); } static void @@ -2324,7 +2324,7 @@ test_group_parse (void) g_option_context_add_group (context, group); argv = split_string ("program --test arg1 -f arg2 --group-test arg3 --frob arg4 -z arg5", &argc); - orig_argv = g_memdup (argv, (argc + 1) * sizeof (char *)); + orig_argv = g_memdup2 (argv, (argc + 1) * sizeof (char *)); retval = g_option_context_parse (context, &argc, &argv, &error); diff --git a/glib/tests/uri.c b/glib/tests/uri.c index 2c610382b..1f3209f97 100644 --- a/glib/tests/uri.c +++ b/glib/tests/uri.c @@ -410,7 +410,7 @@ test_uri_unescape_bytes (gconstpointer test_data) else { escaped_len = strlen (tests[i].escaped); /* no trailing nul */ - escaped = g_memdup (tests[i].escaped, escaped_len); + escaped = g_memdup2 (tests[i].escaped, escaped_len); } bytes = g_uri_unescape_bytes (escaped, escaped_len, tests[i].illegal, &error); @@ -1591,7 +1591,7 @@ test_uri_iter_params (gconstpointer test_data) else { uri_len = strlen (params_tests[i].uri); /* no trailing nul */ - uri = g_memdup (params_tests[i].uri, uri_len); + uri = g_memdup2 (params_tests[i].uri, uri_len); } /* Run once without extracting the attr or value, just to check the numbers. */ @@ -1658,7 +1658,7 @@ test_uri_parse_params (gconstpointer test_data) else { uri_len = strlen (params_tests[i].uri); /* no trailing nul */ - uri = g_memdup (params_tests[i].uri, uri_len); + uri = g_memdup2 (params_tests[i].uri, uri_len); } params = g_uri_parse_params (uri, uri_len, params_tests[i].separators, params_tests[i].flags, &err);