fix: bound null-terminated string read to packet end#4161
fix: bound null-terminated string read to packet end#4161wellwelwel merged 1 commit intosidorares:masterfrom
null-terminated string read to packet end#4161Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #4161 +/- ##
=======================================
Coverage 90.41% 90.41%
=======================================
Files 86 86
Lines 13977 13977
Branches 1728 1728
=======================================
Hits 12638 12638
Misses 1339 1339
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Thanks for your work! |
Thanks too, @peaktwilight! "Finding 1" has some more complex concepts to consider when fixing, such as multiple ways to approach corrections, including avoiding breaking changes. I'll think about this a little more calmly before submitting a PR 🙋🏻♂️ |
|
Awesome thanks so much and lmk if I can help with that one too. Also is it worth doing an advisory for this or not? Tbh not sure :D |
I do believe it is valid (all tests prove the points). Just if possible, wait for #4160 to be merged, submitting the complete report already including the fixes 🤝 |
|
Yup will do for sure, I'll also wait on the release to be out to be safe before publishing any kind of writeup. Gn! |
Previously, the
nullbyte scan could read beyond the current packet into adjacent data in the same backing Buffer.readNullTerminatedStringnow stops at the logical packet boundary.Credits: The fix used was totally made by @peaktwilight: