Re: Buffer overflow in SerializeLibraryState() found by Address Sanitizer

But just seeing now that size in EstimateLibraryState() is initialized to 1. So that total size should actually be fine. Weird that the patch makes the sanitizer error disappear. On 6/10/2025 4:21 PM, David Geier wrote: The loop advances the pointer via start_address += len. -- David Geier (

Re: Buffer overflow in SerializeLibraryState() found by Address Sanitizer

The loop advances the pointer via start_address += len. -- David Geier (ServiceNow On 6/10/2025 3:06 PM, Daniel Gustafsson wrote: On 10 Jun 2025, at 14:59, David Geier wrote: Hi hackers! SerializeLibraryState() writes 1 byte too much into the buffer pointed to by start_address. This is the

Re: Buffer overflow in SerializeLibraryState() found by Address Sanitizer

> On 10 Jun 2025, at 14:59, David Geier wrote: > > Hi hackers! > > SerializeLibraryState() writes 1 byte too much into the buffer pointed to by > start_address. This is the very last '\0' it writes after the loop. Attached > is a patch that fixes the problem by accounting for that extra byte i

Buffer overflow in SerializeLibraryState() found by Address Sanitizer

Hi hackers! SerializeLibraryState() writes 1 byte too much into the buffer pointed to by start_address. This is the very last '\0' it writes after the loop. Attached is a patch that fixes the problem by accounting for that extra byte in EstimateLibraryStateSpace() -- David Geier (ServiceNow)