Onigmo icon indicating copy to clipboard operation
Onigmo copied to clipboard

Fix out of bounds memory read in `add_compile_string`

Open sashashura opened this issue 2 years ago • 0 comments

This PR fixes out of bounds memory read in add_compile_string revealed by fuzzing fluent-bit: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46086

The root cause is that a call to enclen in compile_string_node results in a call to onigenc_mbclen_approximate. When the value of p passed to the function is \xf2 even though it is the last byte in multibyte sequince (the next byte is unexpected string terminator \0) the onigenc_mbclen_approximate returns it's size as 4. The size is added to the overall string length and results in reading past the end of the string.

sashashura avatar Jul 15 '22 18:07 sashashura