Skip to content

Few potential bugs in C++ code #8

Closed
@nsf

Description

Note that these are just a code review thing. I haven't verified it, but it looks like bugs.

  1. As far as I know when you convert a C string to Go string via cgo's C.GoString, the latter doesn't free C string memory. As a result RunScript usage here leaks memory, it might allocate some strings for error structure which are then not freed in getError when being converted to Go strings:

    v8go/context.go

    Lines 58 to 59 in 00d2f88

    rtn := C.RunScript(c.ptr, cSource, cOrigin)
    return getValue(rtn), getError(rtn)

  2. Another memory leak here:

    v8go/value.go

    Line 16 in 00d2f88

    return C.GoString(C.ValueToString(v.ptr))

    ValueToString just does a malloc at the end.

  3. What you do in CopyString and similar places is potentially unsafe. The sprintf usage is unsafe:

    v8go/v8go.cc

    Lines 34 to 38 in 00d2f88

    const char* CopyString(std::string str) {
    char* data = static_cast<char*>(malloc(str.length()));
    sprintf(data, "%s", str.c_str());
    return data;
    }

    IIRC std::string's length returns the length of the string without terminating null byte. And IIRC sprintf writes terminating null byte at the end to the buffer. Since you allocate memory that is 1 byte short of what is written, it's a potential out of bounds write.

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions