mesalink icon indicating copy to clipboard operation
mesalink copied to clipboard

Potential uninitialized memory access in `mesalink_BIO_new_mem_buf`

Open shinmao opened this issue 10 months ago • 0 comments

Hi, I found that the function mesalink_BIO_new_mem_buf might incorrectly assume buf_ptr points to any type that has non-zero length (all the example cases also show the assumption); however, it ignores the case that buf_ptr could also point to struct type. https://github.com/mesalock-linux/mesalink/blob/ef12dd6339e42a37a2c24fa4b8f0a3ce155563a5/src/libcrypto/bio.rs#L720-L733 Even in C, the struct could also contain padding bytes, which means the slice created at line 733 might point to uninitialized padding bytes. We consider that the function could add pre-condition check to make sure buf_ptr is kind of plain old data.

shinmao avatar Apr 13 '24 17:04 shinmao