awslabs/aws-c-common

aws_secure_zero: undefined behaviour when zeroing a NULL buffer

grrtrr opened this issue · 1 comments

This was found via ubsan analyzer in aws-c-common 0.8.5, but problem is also present on master.

Problem description

The following error results when using the ubsan analyzer:

external/aws-c-common/source/common.c:51:12: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:60:62: note: nonnull attribute specified here
    #0 0x7fca17fb9f68 in aws_secure_zero external/aws-c-common/source/common.c:51
    #1 0x7fca17fa23ca in s_aws_byte_buf_append_dynamic external/aws-c-common/source/byte_buf.c:720
    #2 0x7fca17fa2bd1 in aws_byte_buf_append_dynamic_secure external/aws-c-common/source/byte_buf.c:754
    #3 0x7fca180095cd in aws_byte_buf_append_json_string external/aws-c-common/source/json.c:406
    #4 0x7fca18740f1d in s_parse_endpoints_rule_data_endpoint external/aws-c-sdkutils/source/endpoints_ruleset.c:620
    #5 0x7fca1873ea95 in s_on_rule_element external/aws-c-sdkutils/source/endpoints_ruleset.c:785
    #6 0x7fca18008f8f in aws_json_const_iterate_array external/aws-c-common/source/json.c:272
    #7 0x7fca1873d88b in s_init_array_from_json external/aws-c-sdkutils/source/endpoints_ruleset.c:173
    #8 0x7fca18742212 in s_parse_endpoints_rule_data_tree external/aws-c-sdkutils/source/endpoints_ruleset.c:719
    #9 0x7fca1873f249 in s_on_rule_element external/aws-c-sdkutils/source/endpoints_ruleset.c:802
...

The first reference is to aws_secure_zero

// aws-c-common/source/common.c
void aws_secure_zero(void *pBuf, size_t bufsize) {
// ...
    memset(pBuf, 0, bufsize);
// ...
}

However, memset does not accept a NULL pointer:

// /usr/include/string.h
/* Set N bytes of S to C.  */
extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1));

What to do

Return early in aws_secure_zero when either pBuf is NULL or bufsize is 0.

Oops, didn't see that you'd already made a pull-reqeust