NDPluginAttrPlot: fix <= off-by-one that grows the attribute list past its buffers#595
Merged
Merged
Conversation
…uffers
rebuild_attributes() discovered attributes with the loop guard
attr != NULL && attributes_.size() <= n_attributes_
The size is tested before the push_back inside the body, so when
attributes_.size() == n_attributes_ the condition n <= n is still true,
the body runs, and one more name is appended -- leaving
attributes_.size() == n_attributes_ + 1.
data_ is constructed with exactly n_attributes_ circular buffers. On the
next frame push_data() takes length = attributes_.size() and loops
for (i < length) data_[i].push_back(...), so data_[n_attributes_] is an
out-of-bounds operator[] on the buffer vector -- a heap out-of-bounds
write, reachable on the first frame whenever an NDArray carries more
numeric attributes than the configured n_attributes.
Use < so the list is capped at exactly n_attributes_ entries, matching
the buffer count.
Verified with an AddressSanitizer proof driver: with <= the list reaches
5 entries against 4 buffers and data_[4].push_back triggers a
heap-buffer-overflow; with < it stops at 4 and completes cleanly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rebuild_attributes()guards discovery withattributes_.size() <= n_attributes_; testing size before the append lets the list reachn_attributes_ + 1.data_holds exactlyn_attributes_circular buffers, sopush_data()'sfor (i<length) data_[i].push_back(...)reachesdata_[n_attributes_]— a heap out-of-boundsoperator[]on the first frame whenever an NDArray carries more numeric attributes than configured. Change<=to<. Proven with an AddressSanitizer driver: 5 numeric attrs againstn_attributes_=4overflows before, completes clean after.