aws_secure_zero: undefined behaviour when zeroing a NULL buffer
grrtrr opened this issue · 1 comments
grrtrr commented
This was found via ubsan
analyzer in aws-c-common
0.8.5, but problem is also present on master
.
Problem description
The following error results when using the ubsan
analyzer:
external/aws-c-common/source/common.c:51:12: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:60:62: note: nonnull attribute specified here
#0 0x7fca17fb9f68 in aws_secure_zero external/aws-c-common/source/common.c:51
#1 0x7fca17fa23ca in s_aws_byte_buf_append_dynamic external/aws-c-common/source/byte_buf.c:720
#2 0x7fca17fa2bd1 in aws_byte_buf_append_dynamic_secure external/aws-c-common/source/byte_buf.c:754
#3 0x7fca180095cd in aws_byte_buf_append_json_string external/aws-c-common/source/json.c:406
#4 0x7fca18740f1d in s_parse_endpoints_rule_data_endpoint external/aws-c-sdkutils/source/endpoints_ruleset.c:620
#5 0x7fca1873ea95 in s_on_rule_element external/aws-c-sdkutils/source/endpoints_ruleset.c:785
#6 0x7fca18008f8f in aws_json_const_iterate_array external/aws-c-common/source/json.c:272
#7 0x7fca1873d88b in s_init_array_from_json external/aws-c-sdkutils/source/endpoints_ruleset.c:173
#8 0x7fca18742212 in s_parse_endpoints_rule_data_tree external/aws-c-sdkutils/source/endpoints_ruleset.c:719
#9 0x7fca1873f249 in s_on_rule_element external/aws-c-sdkutils/source/endpoints_ruleset.c:802
...
The first reference is to aws_secure_zero
// aws-c-common/source/common.c
void aws_secure_zero(void *pBuf, size_t bufsize) {
// ...
memset(pBuf, 0, bufsize);
// ...
}
However, memset
does not accept a NULL pointer:
// /usr/include/string.h
/* Set N bytes of S to C. */
extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1));
What to do
Return early in aws_secure_zero
when either pBuf
is NULL or bufsize
is 0.
graebm commented
Oops, didn't see that you'd already made a pull-reqeust