luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-07-30 22:03:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

gstrfuncs: Add g_memdup2() function

Browse Source 
This will replace the existing `g_memdup()` function, which has an
unavoidable security flaw of taking its `byte_size` argument as a
`guint` rather than as a `gsize`. Most callers will expect it to be a
`gsize`, and may pass in large values which could silently be truncated,
resulting in an undersize allocation compared to what the caller
expects.

This could lead to a classic buffer overflow vulnerability for many
callers of `g_memdup()`.

`g_memdup2()`, in comparison, takes its `byte_size` as a `gsize`.

Spotted by Kevin Backhouse of GHSL.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
Helps: GHSL-2021-045
Helps: #2319
This commit is contained in:
Philip Withnall
2021-02-04 13:30:52 +00:00
parent 8385664f47
commit f8cf0b8672
4 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
glib/tests/strfuncs.c
View File

@@ -221,6 +221,26 @@ test_memdup (void)
g_free (str_dup);
}
/* Testing g_memdup2() function with various positive and negative cases */
static void
test_memdup2 (void)
{
gchar *str_dup = NULL;
const gchar *str = "The quick brown fox jumps over the lazy dog";
/* Testing negative cases */
g_assert_null (g_memdup2 (NULL, 1024));
g_assert_null (g_memdup2 (str, 0));
g_assert_null (g_memdup2 (NULL, 0));
/* Testing normal usage cases */
str_dup = g_memdup2 (str, strlen (str) + 1);
g_assert_nonnull (str_dup);
g_assert_cmpstr (str, ==, str_dup);
g_free (str_dup);
}
/* Testing g_strpcpy() function with various positive and negative cases */
static void
test_stpcpy (void)
@@ -2539,6 +2559,7 @@ main (int argc,
g_test_add_func ("/strfuncs/has-prefix", test_has_prefix);
g_test_add_func ("/strfuncs/has-suffix", test_has_suffix);
g_test_add_func ("/strfuncs/memdup", test_memdup);
g_test_add_func ("/strfuncs/memdup2", test_memdup2);
g_test_add_func ("/strfuncs/stpcpy", test_stpcpy);
g_test_add_func ("/strfuncs/str_match_string", test_str_match_string);
g_test_add_func ("/strfuncs/str_tokenize_and_fold", test_str_tokenize_and_fold);