kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't pass NULL,0 to qsort.

Browse Source 
qsort shares the same C language bug as mem*. Two of our calls may see
zero-length lists. This trips UBSan.

Change-Id: Id292dd277129881001eb57b1b2db78438cf4642e
Reviewed-on: https://boringssl-review.googlesource.com/c/34447
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
David Benjamin 2019-01-21 20:33:09 +00:00 committed by Adam Langley
parent 9847cdd785
commit 14c611cf91
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/stack/stack.c
View File

@ -358,8 +358,6 @@ err:
} }
void sk_sort(_STACK *sk) { void sk_sort(_STACK *sk) {
int (*comp_func)(const void *,const void *);
if (sk == NULL || sk->comp == NULL || sk->sorted) { if (sk == NULL || sk->comp == NULL || sk->sorted) {
return; return;
} }
@ -370,8 +368,11 @@ void sk_sort(_STACK *sk) {
// e.g., CFI does not notice. Unfortunately, |qsort| is missing a void* // e.g., CFI does not notice. Unfortunately, |qsort| is missing a void*
// parameter in its callback and |qsort_s| / |qsort_r| are a mess of // parameter in its callback and |qsort_s| / |qsort_r| are a mess of
// incompatibility. // incompatibility.
comp_func = (int (*)(const void *, const void *))(sk->comp); if (sk->num >= 2) {
int (*comp_func)(const void *, const void *) =
(int (*)(const void *, const void *))(sk->comp);
qsort(sk->data, sk->num, sizeof(void *), comp_func); qsort(sk->data, sk->num, sizeof(void *), comp_func);
}
sk->sorted = 1; sk->sorted = 1;
} }

4
ssl/ssl_privkey.cc
View File

@ -553,6 +553,10 @@ static int compare_uint16_t(const void *p1, const void *p2) {
} }
static bool sigalgs_unique(Span<const uint16_t> in_sigalgs) { static bool sigalgs_unique(Span<const uint16_t> in_sigalgs) {
if (in_sigalgs.size() < 2) {
return true;
}
Array<uint16_t> sigalgs; Array<uint16_t> sigalgs;
if (!sigalgs.CopyFrom(in_sigalgs)) { if (!sigalgs.CopyFrom(in_sigalgs)) {
return false; return false;