Fix: python textformatting ASAN overflow #109441

Philipp Oeser · 2023-06-28T13:54:32+02:00

Philipp Oeser commented

2023-06-28 13:54:32 +02:00

Since 3f26bdf840, text_format_string_literal_find is used to get the
length of the string literal. This can return -1 though and this can
lead to accessing negative index in the string afterwards.

Now, let text_format_string_literal_find return 0 (instead of -1) since 0
is never going to be a valid string length anyways.

Since 3f26bdf840ab, `text_format_string_literal_find` is used to get the length of the string literal. This can return -1 though and this can lead to accessing negative index in the string afterwards. Now, let `text_format_string_literal_find` return 0 (instead of -1) since 0 is never going to be a valid string length anyways.

Philipp Oeser added 1 commit 2023-06-28 13:54:44 +02:00

2596401ea1 Fix: textformatting ASAN overflow

Since 3f26bdf840, `text_format_string_literal_find` is used to get the
length of the string literal. This can return -1 though and this can
lead to accessing negative index in the string afterwards.

The checks following `text_format_string_literal_find` now have been
adjusted to take -1 into account.

Philipp Oeser requested review from Campbell Barton 2023-06-28 13:54:51 +02:00

Philipp Oeser added this to the Python API project 2023-06-28 13:55:01 +02:00

Campbell Barton commented

2023-06-28 14:00:43 +02:00

Checking the way text_format_string_literal_find is used and I think it could return 0 instead of -1, since 0 is never going to be a valid string length. It's a one liner change, but the doc-string will need updating.

Checking the way `text_format_string_literal_find` is used and I think it could return 0 instead of -1, since 0 is never going to be a valid string length. It's a one liner change, but the doc-string will need updating.

Philipp Oeser added 1 commit 2023-06-28 14:09:06 +02:00

94976b4d39 let text_format_string_literal_find() return 0 instead of -1

makes the patch shorter and 0 is never going to be a valid string length
anyways.

Campbell Barton approved these changes 2023-06-28 14:09:44 +02:00

Philipp Oeser merged commit ab215965c6 into main

2023-06-28 14:14:10 +02:00

Philipp Oeser referenced this issue from a commit

2023-06-28 14:14:11 +02:00

Fix: python textformatting ASAN overflow

Philipp Oeser deleted branch textformatting_overflow

2023-06-28 14:14:11 +02:00

Christoph Lendenfeld referenced this issue from a commit

2023-07-06 10:14:58 +02:00

Fix: python textformatting ASAN overflow

Sign in to join this conversation.

No reviewers

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Fix: python textformatting ASAN overflow #109441