Repository navigation
lib: use checked size arithmetic for internal container growth - #305
Merged
Merged
Conversation
Route every allocation-size computation in the string buffer, string vector and setting list code through two small helpers in util.c: libconfig_reallocarray() checks nmemb * size before reallocating libconfig_size_add() checks a + b If a size cannot be represented in a size_t, the helpers call the fatal error handler, exactly as libconfig_malloc() and friends already do for an allocation failure, so the existing config_set_fatal_error_func() hook covers it. Also: - libconfig_strbuf_append_string() and config_default_include_func() copy with memcpy() using lengths they have already computed, instead of strcpy()/strcat(). - __config_list_remove() takes an unsigned index (matching its callers and config_list_t.length) and moves elements with typed pointer arithmetic instead of an int byte offset. - The include file array is allocated with libconfig_calloc(2, sizeof(const char *)) instead of sizeof(char **) * 2. Parsed values and written output are unchanged, and there are no public API or ABI changes. New tests cover list growth and removal across allocation chunks, long concatenated strings, include-directory path joining, and more include files than the file name vector chunk size.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The string buffer, string vector and setting list code compute allocation sizes inline (
n * size,a + b + 1). This routes them through two checkedutil.chelpers,libconfig_reallocarray()andlibconfig_size_add(). A size that doesn't fit insize_tgoes to the fatal error handler, as allocation failures already do, so the container code is harder to misuse as it evolves.Also:
strcpy/strcatbecomememcpyof known lengths instrbuf.candconfig_default_include_func(), and__config_list_remove()takes an unsigned index with typed pointer arithmetic.Parsed values and written output are unchanged. No API or ABI changes. Tested on Ubuntu 24.04 with gcc 13 and clang 18 (CMake and autotools test suites, fuzzer corpus replay), with three new tests.
If it lands, we may submit it to Google's Patch Rewards program, and we'd be glad to share any reward with the maintainers.
— ChipLab