Skip to content

Fix self-referential writecopy after buffer growth - #106

Open
carrerasdarren-cell wants to merge 1 commit into
xiph:mainfrom
carrerasdarren-cell:fix-writecopy-self-alias
Open

Fix self-referential writecopy after buffer growth#106
carrerasdarren-cell wants to merge 1 commit into
xiph:mainfrom
carrerasdarren-cell:fix-writecopy-self-alias

Conversation

@carrerasdarren-cell

Copy link
Copy Markdown

Summary

  • Preserve a writecopy source that points into the destination buffer when
    growing that buffer moves its allocation.
  • Add self-referential copy coverage for both bit orders and for aligned and
    unaligned destinations.

Problem

oggpack_writecopy_helper saves its source pointer, expands b->buffer with
realloc, and then consumes the saved pointer. If the source points into
b->buffer and growth moves the allocation, the aligned memmove or the
unaligned byte loop reads freed storage.

A 192-byte self-copy that grows the initial 256-byte buffer reliably reports:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 192
    #1 oggpack_writecopy_helper bitwise.c:214
freed by thread T0 here:
    #1 oggpack_writecopy_helper bitwise.c:200

The patch records an internal source's byte offset before growth and rebases
it after a successful realloc. External sources are unchanged.

Validation

  • Autotools make check with Clang -Wall -Wextra -Werror: 2/2 pass
  • CMake Release test_bitwise and test_framing: pass
  • CMake ASan/UBSan test_bitwise and test_framing: pass
  • Standalone reproducer under ASan/UBSan: fails before, passes after
  • Strict C89 build with -pedantic-errors -Wall -Wextra -Werror: pass
  • Clang static analyzer: no findings

Preserve the source offset when writecopy grows a destination whose source points into the same allocation. Add aligned and unaligned self-copy coverage for both bit orders.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant