Skip to content

[mono] Prevent memory corruption when decoding UCO entry point #86266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 16, 2023
Merged

[mono] Prevent memory corruption when decoding UCO entry point #86266

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions src/mono/mono/mini/aot-compiler.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5352,10 +5352,16 @@ MONO_RESTORE_WARNING
for (j = 0; j < decoded_args->named_args_num; ++j) {
if (decoded_args->named_args_info [j].field && !strcmp (decoded_args->named_args_info [j].field->name, "EntryPoint")) {
named = (const char *)decoded_args->named_args[j]->value.primitive;
slen = mono_metadata_decode_value (named, &named) + (int)strlen(acfg->user_symbol_prefix);
export_name = (char *)g_malloc (slen + 1);
sprintf (export_name, "%s%s", acfg->user_symbol_prefix, named);
Copy link
Member

@filipnavara filipnavara May 15, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW this could have been modified to

namedlen = mono_metadata_decode_value (named, &named);
slen = namedlen + (int)strlen(acfg->user_symbol_prefix);
export_name = (char *)g_malloc (slen + 1);
sprintf (export_name, "%s%.*s", acfg->user_symbol_prefix, namedlen, named);

(+ declaration of namedlen)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your suggestion.
However, even though it achieves the same thing, I prefer not to use sprintf as originally it hid the underlying problem that was difficult to track down. So for that reason, I will keep it as is (simple and easily debuggable).

export_name [slen] = 0;
slen = mono_metadata_decode_value (named, &named);

int prefix_len = (int)strlen (acfg->user_symbol_prefix);
g_assert (prefix_len < 2);

export_name = (char *)g_malloc (prefix_len + slen + 1);
if (prefix_len == 1)
export_name[0] = *acfg->user_symbol_prefix;
memcpy (export_name + prefix_len, named, slen);
export_name [prefix_len + slen] = '\0';

g_ptr_array_add (acfg->exported_methods, method);
}
Expand Down