mesalink
mesalink copied to clipboard
Potential uninitialized memory access in `mesalink_BIO_new_mem_buf`
Hi, I found that the function mesalink_BIO_new_mem_buf
might incorrectly assume buf_ptr
points to any type that has non-zero length (all the example cases also show the assumption); however, it ignores the case that buf_ptr
could also point to struct
type.
https://github.com/mesalock-linux/mesalink/blob/ef12dd6339e42a37a2c24fa4b8f0a3ce155563a5/src/libcrypto/bio.rs#L720-L733
Even in C, the struct
could also contain padding bytes, which means the slice created at line 733 might point to uninitialized padding bytes. We consider that the function could add pre-condition check to make sure buf_ptr
is kind of plain old data.