[Boost-bugs] [Boost C++ Libraries] #13111: Out-of-bounds access for asio consuming buffers

Subject: [Boost-bugs] [Boost C++ Libraries] #13111: Out-of-bounds access for asio consuming buffers
From: Boost C++ Libraries (noreply_at_[hidden])
Date: 2017-07-07 14:37:53

#13111: Out-of-bounds access for asio consuming buffers
------------------------------+----------------------------
 Reporter:  ben@…             |      Owner:  chris_kohlhoff
     Type:  Bugs              |     Status:  new
Milestone:  To Be Determined  |  Component:  asio
  Version:  Boost 1.66.0      |   Severity:  Problem
 Keywords:                    |
------------------------------+----------------------------
 I have not seen a fix for this in Github for the latest version

 https://github.com/boostorg/asio/blob/develop/include/boost/asio/detail/consuming_buffers.hpp

 The issue was found by a coverity scan. All calls to buffers_.end() are
 being flagged as out-of-bounds access, there is potential for memory
 corruption here. Coverity is flagging these as High Impacting.

 Coverity output is below:

 {{{

 207  // Get a forward-only iterator to the first element.
 208  const_iterator begin() const
 209Â Â {

 1. address_of: Taking address with this->buffers_ yields a singleton
 pointer.

 CID 336466: Out-of-bounds access (ARRAY_VS_SINGLETON)2. callee_ptr_arith:
 Passing this->buffers_ to function end which uses it as an array. This
 might corrupt or misinterpret adjacent memory locations.
 210    return const_iterator(at_end_, first_,
 211        begin_remainder_, buffers_.end(), max_size_);
 212Â Â }
 213

 …

 226  // Consume the specified number of bytes from the buffers.
 227  void consume(std::size_t size)
 228Â Â {
 229    // Remove buffers from the start until the specified size is
 reached.

 1. Condition size > 0, taking true branch.

 2. Condition !this->at_end_, taking true branch.
 230    while (size > 0 && !at_end_)
 231Â Â Â Â {

 3. Condition boost::asio::buffer_size(this->first_) <= size, taking true
 branch.
 232      if (buffer_size(first_) <= size)
 233Â Â Â Â Â Â {
 234        size -= buffer_size(first_);

 4. address_of: Taking address with this->buffers_ yields a singleton
 pointer.

 CID 336464: Out-of-bounds access (ARRAY_VS_SINGLETON)5. callee_ptr_arith:
 Passing this->buffers_ to function end which uses it as an array. This
 might corrupt or misinterpret adjacent memory locations.
 235        if (begin_remainder_ == buffers_.end())
 236Â Â Â Â Â Â Â Â Â Â at_end_Â =Â true;
 237Â Â Â Â Â Â Â Â else
 238Â Â Â Â Â Â Â Â Â Â first_Â =Â *begin_remainder_++;
 239Â Â Â Â Â Â }
 240Â Â Â Â Â Â else
 241Â Â Â Â Â Â {
 242Â Â Â Â Â Â Â Â first_Â =Â first_Â +Â size;
 243        size = 0;
 244Â Â Â Â Â Â }
 245Â Â Â Â }

 …

 247    // Remove any more empty buffers at the start.

 12. Condition !this->at_end_, taking true branch.

 13. Condition boost::asio::buffer_size(this->first_) == 0, taking true
 branch.
 248    while (!at_end_ && buffer_size(first_) == 0)
 249Â Â Â Â {

 14. address_of: Taking address with this->buffers_ yields a singleton
 pointer.

 CID 336464: Out-of-bounds access (ARRAY_VS_SINGLETON)15. callee_ptr_arith:
 Passing this->buffers_ to function end which uses it as an array. This
 might corrupt or misinterpret adjacent memory locations.
 250      if (begin_remainder_ == buffers_.end())
 251Â Â Â Â Â Â Â Â at_end_Â =Â true;
 252Â Â Â Â Â Â else
 253Â Â Â Â Â Â Â Â first_Â =Â *begin_remainder_++;
 254Â Â Â Â }
 255Â Â }

 …

 }}}

-- 
Ticket URL: <https://svn.boost.org/trac10/boost/ticket/13111>
Boost C++ Libraries <http://www.boost.org/>
Boost provides free peer-reviewed portable C++ source libraries.