Security: Invalid write in FSS processing functions due to improper allocation size.

The start and stop ranges are inclusive.
This means that the size is (stop - start) + 1.

The problems happens where the code is adding additional digits to represent end of line or other special characters.
When this is added, I seem to have forgotten to add the additional numbers to the + 1 and instead replaced the + 1.
This results in the size being potentially short by a single character and thus an invalid write is possible.

diff --git a/level_1/fl_fss/c/fss/basic.c b/level_1/fl_fss/c/fss/basic.c
index ec389188599ee1ac64f56d7942a6fa903b2382d5..d47e02e2812529e563849f26bfbabd5a40b9d997 100644 (file)
--- a/level_1/fl_fss/c/fss/basic.c
+++ b/level_1/fl_fss/c/fss/basic.c
@@ -181,7 +181,7 @@ extern "C" {
     }
 
     // Ensure that there is room for the potential terminating newline.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 1, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 2, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t destination_used = destination->used;

diff --git a/level_1/fl_fss/c/fss/basic_list.c b/level_1/fl_fss/c/fss/basic_list.c
index 0617ff1144b88f235e9087ed79d2a1c0a9557e08..28ded1539cbc1cb794a34ae12a9527f12ccba5ff 100644 (file)
--- a/level_1/fl_fss/c/fss/basic_list.c
+++ b/level_1/fl_fss/c/fss/basic_list.c
@@ -585,7 +585,7 @@ extern "C" {
     }
 
     // Ensure that there is room for a slash delimit, the object open character, and the end of line character.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 3, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 4, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t used_start = destination->used;
@@ -799,7 +799,7 @@ extern "C" {
     }
 
     // Ensure that there is room for a slash delimit and possibly the end of content character.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 2, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 3, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t used_start = destination->used;

diff --git a/level_1/fl_fss/c/fss/embedded_list.c b/level_1/fl_fss/c/fss/embedded_list.c
index fd660830c6d8827500e649d62f8b6cc4bba55e3a..c8fe8d222e97e30e56ee9c47b86043b9a194317a 100644 (file)
--- a/level_1/fl_fss/c/fss/embedded_list.c
+++ b/level_1/fl_fss/c/fss/embedded_list.c
@@ -1001,7 +1001,7 @@ extern "C" {
     }
 
     // Ensure that there is room for a slash delimit, the object open character, and the end of line character.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 3, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 4, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t used_start = destination->used;
@@ -1237,7 +1237,7 @@ extern "C" {
     }
 
     // Ensure that there is room for a slash delimit and possibly the end of content characters.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 3, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 4, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t used_start = destination->used;

diff --git a/level_1/fl_fss/c/fss/extended_list.c b/level_1/fl_fss/c/fss/extended_list.c
index 6c93dc8ff293de55b811b166bd856b238edc6181..33d8b3423a671cf8feaa411991e14bce63f0392a 100644 (file)
--- a/level_1/fl_fss/c/fss/extended_list.c
+++ b/level_1/fl_fss/c/fss/extended_list.c
@@ -548,7 +548,7 @@ extern "C" {
     }
 
     // Ensure that there is room for a slash delimit, the object open character, and the end of line character.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 3, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 4, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t used_start = destination->used;
@@ -784,7 +784,7 @@ extern "C" {
     }
 
     // Ensure that there is room for a slash delimit and possibly the end of content characters.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 3, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 4, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t used_start = destination->used;

diff --git a/level_1/fl_fss/c/private-fss.c b/level_1/fl_fss/c/private-fss.c
index 7da2ef0f041edfe0f5cc25a5e5e714af476012de..cd90c510b2b621f06eef4556c394f4777fba9c4c 100644 (file)
--- a/level_1/fl_fss/c/private-fss.c
+++ b/level_1/fl_fss/c/private-fss.c
@@ -856,7 +856,7 @@ extern "C" {
     }
 
     // Ensure that there is room for the potential start and stop quotes, a potential delimit at start, and the potential object open character.
-    status = f_string_dynamic_increase_by((range->stop - range->start) + 4, destination);
+    status = f_string_dynamic_increase_by((range->stop - range->start) + 5, destination);
     if (F_status_is_error(status)) return status;
 
     const f_array_length_t input_start = range->start;