1309133 - [Static Analysis][Buffer not null terminated] In function SandboxBroker::ThreadMain

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Andi [:andi]]

The Static Analysis tool Coverity detected that a buffer not null terminated occurs in this following context:

>>strncpy(pathBuf2, recvBuf + first_len + 1, kMaxPathLen + 1);

This can happen since the size of of |pathBuf2| is kMaxPathLen + 1 so the 3rd argument of strncpy might be kMaxPathLen

Comment 1

[Andi [:andi]]

Attachment: Bug 1309133 - null terminate pathBuf2 in SandboxBroker::ThreadMain.

Review commit: https://reviewboard.mozilla.org/r/84782/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/84782/

Comment 2

[Gian-Carlo Pascutto [:gcp]]

If you read the comment right above that line, that is 100% intentional:

      // We do not assume the second path is 0-terminated, this is
      // enforced below.
      strncpy(pathBuf2, recvBuf + first_len + 1, kMaxPathLen + 1);

The bug is:

        // Force 0 termination.
        pathBuf[pathLen2] = '\0';

Which should've been pathBuf2[...]

Comment 3

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8799634 [details]
Bug 1309133 - null terminate pathBuf2 in SandboxBroker::ThreadMain.

https://reviewboard.mozilla.org/r/84782/#review83418

Comment 4

[Andi [:andi]]

Comment on attachment 8799634 [details]
Bug 1309133 - null terminate pathBuf2 in SandboxBroker::ThreadMain.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/84782/diff/1-2/

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Attachment: Bug 1309133 - Ensure termination of the correct buffer.

Review commit: https://reviewboard.mozilla.org/r/84862/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/84862/

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8799634 [details]
Bug 1309133 - null terminate pathBuf2 in SandboxBroker::ThreadMain.

https://reviewboard.mozilla.org/r/84782/#review83424

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ed40af32ba48
null terminate pathBuf2 in SandboxBroker::ThreadMain. r=gcp

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8799723 [details]
Bug 1309133 - Ensure termination of the correct buffer.

https://reviewboard.mozilla.org/r/84862/#review83426

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ed40af32ba48