admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dcsctp: Do explicit bounds checking in bounded IO

Browse Source 
The previous approach was that the caller was responsible for ensuring
that any buffer passed in to the Bounded IO wrappers, and that any
offset from where sub-readers were created were valid. The called would
always do a validation of the data and return proper error messages
if they were not.

This didn't pan out. https://crbug.com/1216758 found an overflow that
fooled the validation logic and the fuzzer could read out-of-bounds,
although it would always crash in that particular case.

There was already bounds checking, but under DCHECKs. This CL changes
that so that any bounds checking is done with CHECKS, as would've been
done in Rust. It's better to crash than to read arbitrary memory.

Bug: chromium:1216758
Change-Id: I89b52f0758495b5fe46f926c142870a263b96314
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/221743
Commit-Queue: Victor Boivie <boivie@webrtc.org>
Reviewed-by: Florent Castelli <orphis@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#34303}
This commit is contained in:
Victor Boivie 2021-06-09 09:24:26 +02:00 committed by WebRTC LUCI CQ
parent 72b79986a5
commit d579e6bc7b
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/dcsctp/packet/bounded_byte_reader.h
View File

@ -52,7 +52,7 @@ template <int FixedSize>
class BoundedByteReader {
public:
explicit BoundedByteReader(rtc::ArrayView<const uint8_t> data) : data_(data) {
RTC_DCHECK(data.size() >= FixedSize);
RTC_CHECK(data.size() >= FixedSize);
}
template <size_t offset>
@ -77,7 +77,7 @@ class BoundedByteReader {
template <size_t SubSize>
BoundedByteReader<SubSize> sub_reader(size_t variable_offset) const {
RTC_DCHECK(FixedSize + variable_offset + SubSize <= data_.size());
RTC_CHECK(FixedSize + variable_offset + SubSize <= data_.size());
rtc::ArrayView<const uint8_t> sub_span =
data_.subview(FixedSize + variable_offset, SubSize);

4
net/dcsctp/packet/bounded_byte_writer.h
View File

@ -56,7 +56,7 @@ template <int FixedSize>
class BoundedByteWriter {
public:
explicit BoundedByteWriter(rtc::ArrayView<uint8_t> data) : data_(data) {
RTC_DCHECK(data.size() >= FixedSize);
RTC_CHECK(data.size() >= FixedSize);
}
template <size_t offset>
@ -81,7 +81,7 @@ class BoundedByteWriter {
template <size_t SubSize>
BoundedByteWriter<SubSize> sub_writer(size_t variable_offset) {
RTC_DCHECK(FixedSize + variable_offset + SubSize <= data_.size());
RTC_CHECK(FixedSize + variable_offset + SubSize <= data_.size());
return BoundedByteWriter<SubSize>(
data_.subview(FixedSize + variable_offset, SubSize));