C-Plus-Plus icon indicating copy to clipboard operation
C-Plus-Plus copied to clipboard

[BUG]Buffer overflow in median_search.cpp due to missing input validation in search/median_search.cpp

Open 18781875724 opened this issue 5 months ago • 4 comments

Description

A buffer overflow vulnerability exists in median_search.cpp when handling empty or invalid input arrays. The error occurs at:

median_search.cpp:79:11: error: buffer overflow, pointer '&m' accesses 0 bytes at offset 0 bytes of local variable 'm' of size 0 bytes pivot = m[(sz- 1) / 2

The code fails to validate input size n in main(), allowing zero/negative values When empty arrays are processed, the median vector m becomes empty Attempting to access m[0] when m.size() == 0 causes buffer overflow

Expected behavior

Input Validation The program should validate all user inputs (array size n and elements) and: Reject non-positive array sizes (n ≤ 0) with a clear error message. Handle empty arrays gracefully (e.g., throw an exception or return an error code). Graceful Error Handling For invalid inputs (e.g., n = 0 or negative sizes): Display a user-friendly error (e.g., "Error: Array size must be a positive integer").

Actual behavior

Crash on Invalid Input

When entering n ≤ 0 (e.g., 0 or -5), the program crashes with a buffer overflow

Steps to reproduce

No response

Context

Blocked Proper Testing While implementing unit tests for edge cases, the crashes on empty/negative inputs prevented me from completing test coverage. The code "works" for normal inputs but fails catastrophically for invalid ones.

Additional information

No response

18781875724 avatar Apr 29 '25 07:04 18781875724