Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix signed/unsigned mismatch in powershell_events #8225

Merged
merged 1 commit into from
Dec 27, 2023

Conversation

ExceptionalHandler
Copy link
Contributor

This fixes #8224

cosine similarity calculation in powershell_events could rollover to using negative indices with special chars in script (#8224)
Converting auto type to unsigned char will force compiler to treat chr as unsigned value which is more in accordance with size_t type used for indices in buffer_freqs .
This also provides an accurate value of cosine-similarity of scripts with special characters.

@mike-myers-tob mike-myers-tob added bug virtual tables Windows ready for review Pull requests that are ready to be reviewed by a maintainer labels Dec 20, 2023
@directionless directionless added this to the 5.11.0 milestone Dec 27, 2023
Copy link
Member

@Smjert Smjert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ExceptionalHandler thanks for catching this!

@Smjert Smjert merged commit 65db9e7 into osquery:master Dec 27, 2023
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug ready for review Pull requests that are ready to be reviewed by a maintainer virtual tables Windows
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[powershell_events]: Buffer overrun due to signed / unsigned match
4 participants