Skip to content

Core: Fix packBits heap-buffer-overflow#9963

Merged
Xaver-DaRed merged 1 commit into
basefrom
heap-buffer-overflow-
May 6, 2026
Merged

Core: Fix packBits heap-buffer-overflow#9963
Xaver-DaRed merged 1 commit into
basefrom
heap-buffer-overflow-

Conversation

@zach2good
Copy link
Copy Markdown
Contributor

@zach2good zach2good commented May 6, 2026

I affirm:

  • I understand that if I do not agree to the following points by completing the checkboxes my PR will be ignored.
  • I understand I should leave resolving conversations to the LandSandBoat team so that reviewers won't miss what was said.
  • I have read and understood the Contributing Guide and the Code of Conduct.
  • I have tested my code and the things my code has changed since the last commit in the PR and will test after any later commits.

What does this pull request do?

Godbolt link: https://godbolt.org/z/abn84e8PT (uncomment Original:: functions to see ASan lose it's shit)

==11932==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000f1 at pc 0x00010025c9a0 bp 0x00016fba1e30 sp 0x00016fba1e28
READ of size 4 at 0x6020000000f1 thread T0
    #0 0x00010025c99c in Original::packBitsBE(...) repro_packbits.cpp:32
    #1 0x00010025cc60 in Original::packBitsLE(...) repro_packbits.cpp:51

0x6020000000f4 is located 0 bytes after 4-byte region [0x6020000000f0,0x6020000000f4)
allocated by thread T0 here:
    #1 0x00010025cb20 in Original::packBitsLE(...) repro_packbits.cpp:46

In packBitsLE, the bytesNeeded logic often calculated a larger buffer (e.g., 4 bytes for 17 bits) and copied the entire buffer back to the target, even if the bitfield only spanned 3 bytes.

Fix:

  • Copy everything into local buffers of the relevant data width before writing them back later: no opportunity for overflow
  • Don't use this: if ((lengthInBit + bitOffset) <= 8)

Testing:
/sea all still works

@zach2good zach2good marked this pull request as ready for review May 6, 2026 09:18
@Xaver-DaRed Xaver-DaRed merged commit 9f70a6b into base May 6, 2026
11 checks passed
@Xaver-DaRed Xaver-DaRed deleted the heap-buffer-overflow- branch May 6, 2026 11:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants