fix(network): check buffer length before reading family in unpack_ip_port - #3073
Conversation
|
Thanks for the pr. We require commits to be signed by the author. I think it would be best to remove those test cases, we have static annotation for a reason. |
|
Alright, on it. What do you think otherwise? |
dcd9696 to
03995e7
Compare
Green-Sky
left a comment
There was a problem hiding this comment.
Looks good, the other change is fine but not changing anything.
|
Also please add your signing public key to github, so it knows it is you :) |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3073 +/- ##
==========================================
- Coverage 69.82% 69.79% -0.04%
==========================================
Files 185 185
Lines 34422 34424 +2
==========================================
- Hits 24035 24025 -10
- Misses 10387 10399 +12 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
cbe33fc to
cd872c5
Compare
Green-Sky
left a comment
There was a problem hiding this comment.
Update op and commit message (usually they are supposed to be a match).
Then it should be ready.
…port In unpack_ip_port, data[0] was accessed without verifying that length > 0, causing a potential 1-byte out-of-bounds read on 0-length input. Additionally, checked ip_port and data before dereferencing. In unpack_nodes, add an entry check verifying nodes is non-null when max_num_nodes > 0. Added boundary unit tests in auto_tests/network_test.c covering zero-length inputs, truncated IPv4/IPv6 buffers, and invalid address families.
cd872c5 to
02daf25
Compare
In
unpack_ip_port,data[0]was accessed without verifying thatlength > 0, causing a potential 1-byte out-of-bounds read on 0-length input. Additionally, checkedip_portanddatabefore dereferencing.In
unpack_nodes, add an entry check verifyingnodesis non-null whenmax_num_nodes > 0.Added boundary unit tests in
auto_tests/network_test.ccovering zero-length inputs, truncated IPv4/IPv6 buffers, and invalid address families.This change is