Avoid format string injection#135
Draft
xtexx wants to merge 2 commits intoloongson:loongarch-portfrom
Draft
Conversation
VMError::report_and_die provides an overload that takes a variable-length argument as the last argument, so we can use it instead of the overload taking va_list as the last argument. The implementation detail of va_list is compiler-defined and constructing a va_list manually is not standardized which may not work as expected. This should resolve the warning saying that report_and_die uses the uninitialized variable of va_dummy. Signed-off-by: Bingwu Zhang <xtex@aosc.io>
The sixth argument of VMError::report_and_die is a formatting string, using detail_msg as the 6th arg leaves a location for formatter injecting, although it is hard to be used because almost all detail_msg point to static strings. This should resolve the Clang warning saying that the formatter string is not constant. Signed-off-by: Bingwu Zhang <xtex@aosc.io>
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove construction va_list manually to avoid undefined behaviour.
Use
%sas formatting string to avoid injection.