LBRYCommunity/lbrycrd
1
0
Fork 0
Code Issues 29 Pull requests 1 Projects Releases 32 Packages Wiki Activity

Merge #14242: Avoid triggering undefined behaviour (std::memset(nullptr, 0, 0)) if an invalid string is passed to DecodeSecret(...)

Browse source 
d855e4cac8 Avoid triggering undefined behaviour (std::memset(nullptr, 0, 0)) if an invalid string is passed to DecodeSecret(...) (practicalswift)

Pull request description:

  Avoid triggering undefined behaviour (`std::memset(nullptr, 0, 0)`) if an invalid string is passed to `DecodeSecret(...)`.

  Background reading: [memcpy (and friends) with NULL pointers](https://www.imperialviolet.org/2016/06/26/nonnull.html)

  Steps to reproduce:

  ```
  ./configure --with-sanitizers=undefined && make check && ./test/functional/test_runner.py
  ```

Tree-SHA512: b8325ced4f724d9c03065e0747af56b1f297a90d9fb09a24d46c3231a90dce3df6299f2c41f863b5cec18eaeded7b46ee4b93d9a52adc2541eb4c44d2c0965d9
This commit is contained in:
Wladimir J. van der Laan 2019-02-08 11:41:39 +01:00
commit 6fc656a410
No known key found for this signature in database
GPG key ID: 1E4AED62986CD25D
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/key_io.cpp
View file

@ -142,7 +142,9 @@ CKey DecodeSecret(const std::string& str)
key.Set(data.begin() + privkey_prefix.size(), data.begin() + privkey_prefix.size() + 32, compressed); key.Set(data.begin() + privkey_prefix.size(), data.begin() + privkey_prefix.size() + 32, compressed);
} }
} }
memory_cleanse(data.data(), data.size()); if (!data.empty()) {
memory_cleanse(data.data(), data.size());
}
return key; return key;
} }

1
test/sanitizer_suppressions/ubsan
View file

@ -4,7 +4,6 @@ bool:wallet/wallet.cpp
float-divide-by-zero:policy/fees.cpp float-divide-by-zero:policy/fees.cpp
float-divide-by-zero:validation.cpp float-divide-by-zero:validation.cpp
float-divide-by-zero:wallet/wallet.cpp float-divide-by-zero:wallet/wallet.cpp
nonnull-attribute:support/cleanse.cpp
unsigned-integer-overflow:arith_uint256.h unsigned-integer-overflow:arith_uint256.h
unsigned-integer-overflow:basic_string.h unsigned-integer-overflow:basic_string.h
unsigned-integer-overflow:bench/bench.h unsigned-integer-overflow:bench/bench.h