Skip to content

Bound embedded CRC filename scanning - #325

Open
dajiaohuang wants to merge 1 commit into
rhash:masterfrom
dajiaohuang:fix-audit-314-crc-bounds
Open

dajiaohuang wants to merge 1 commit into
rhash:masterfrom
dajiaohuang:fix-audit-314-crc-bounds

Conversation

@dajiaohuang

Copy link
Copy Markdown
Contributor

Fixes #314.

The backward scan now rejects paths shorter than a checksum suffix and guards each decrement so it stays within the filename buffer.

Validation: the base build reports an AddressSanitizer invalid-pointer-pair for --check-embedded a with pointer checks enabled. The fix passes both saved filename regressions in a Linux/GCC 13.3 ASan build with pointer-pair checks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bound the backward scan for embedded CRC32 filenames

1 participant