Skip to content

Insecure string comparison (incomplete comparison) in _convert_from_str of descriptor.c #18993

@awen-li

Description

@awen-li

Reproducing code example:

Snippet:

    /* Check for a deprecated Numeric-style typecode */
    /* `Uint` has deliberately weird uppercasing */
    char *dep_tps[] = {"Bytes", "Datetime64", "Str", "Uint"};
    int ndep_tps = sizeof(dep_tps) / sizeof(dep_tps[0]);
    for (int i = 0; i < ndep_tps; ++i) {
        char *dep_tp = dep_tps[i];
        if (strncmp(type, dep_tp, strlen(dep_tp)) == 0) {   ------> '\0' not considered here, should be strlen(dep_tp)+1. (value of "type" may come from external modules)
            /* Deprecated 2020-06-09, NumPy 1.20 */
            if (DEPRECATE("Numeric-style type codes are "
                          "deprecated and will result in "
                          "an error in the future.") < 0) {
                goto fail;
            }
        }
    }

Error message:

When we run our analysis tool on NumPy, an incomplete comparison problem was reported, see details below:
File: numpy/core/src/multiarray/descriptor.c
Function: _convert_from_str (line 1727 : 1740)
Optional call-path: PyArray_DescrAlignConverter -> _convert_from_any -> _convert_from_str
Details in description

NumPy/Python version information:

the main branch of NumPy

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions