Skip to content

Fix out-of-bounds access in command-line parser #1536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 8, 2021

Conversation

lava
Copy link
Member

@lava lava commented Apr 8, 2021

📔 Description

Fix out-of-bounds access in command-line parser

For some errors, the command-line parser returns `last`
as the position of the error which we must not dereference
when building an error message.

This bug was originally found by an automated fuzzing run
via Code Intelligence.

📝 Checklist

  • All user-facing changes have changelog entries.
  • The changes are reflected on docs.tenzir.com/vast, if necessary.
  • The PR description contains instructions for the reviewer, if necessary.

Copy link
Member

@dominiklohmann dominiklohmann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked this out locally to verify that it fixes the issue.

The CI errors because fptr in the unit tests is unused, but other than that everything runs through locally.

@lava lava force-pushed the story/ch24299/command-oob branch from fb1224d to 40411e7 Compare April 8, 2021 12:35
@lava lava enabled auto-merge April 8, 2021 12:35
@dominiklohmann dominiklohmann added the bug Incorrect behavior label Apr 8, 2021
lava added 2 commits April 8, 2021 14:43
For some errors, the command-line parser returns `last`
as the position of the error which we must not dereference
when building an error message.

This bug was originally found by an automated fuzzing run
via Code Intelligence.
@lava lava force-pushed the story/ch24299/command-oob branch from 40411e7 to 0bf80f9 Compare April 8, 2021 12:52
@lava lava merged commit 8439def into master Apr 8, 2021
@lava lava deleted the story/ch24299/command-oob branch April 8, 2021 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Incorrect behavior
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants