ERROR: AddressSanitizer: global-buffer-overflow in function ErrorIDToName
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
Research direction
Start in tinyxml2.cpp at ErrorIDToName and the _errorNames array, then check the XMLError enum in tinyxml2.h. The array has 19 entries but the enum value XML_ERROR_COUNT (19) can reach the indexing line. Reproduce with the attached fuzzing wrapper under AddressSanitizer. Done when ErrorIDToName no longer reads past the array for XML_ERROR_COUNT and the existing tests still pass.
Written by the indexing model from the issue text.
Description
Instrument Futag found this error with tinyxml2 version 9.0.0 and in current version.
errorID is a variable of XMLError type, which can receive value from XML_SUCCESS (0) to XML_ERROR_COUNT (19)
https://github.com/leethomason/tinyxml2/blob/e45d9d16d430a3f5d3eee9fe40d5e194e1e5e63a/tinyxml2.h#L523-L545
The _errorNames array has 19 elements (from 0 to 18) and was defined here:
https://github.com/leethomason/tinyxml2/blob/e45d9d16d430a3f5d3eee9fe40d5e194e1e5e63a/tinyxml2.cpp#L2136-L2156
So, when errorID gets XML_ERROR_COUNT value, error occurs at instruction const char* errorName = _errorNames[errorID];
The generated fuzzing wrapper is attached below.
ErrorIDToName1.cpp.zip
- Dominant language
- C++
- Stars
- 5.8k
- Forks
- 2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from leethomason/tinyxml2
-
CDATA output containing ]]> is not well-formed XMLPossibly taken @bconnnnn claimed this 9 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
leethomason/tinyxml2#1097 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
leethomason/tinyxml2#914 ·
-
New release requestOpen
Difficulty 2/5 Under an hour Newbie friendliness 15/100
leethomason/tinyxml2#1087 · 4 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 18/100
leethomason/tinyxml2#1085 · 1 comment ·
-
New relase requestOpen
Difficulty 5/5 Over a week Newbie friendliness 8/100
leethomason/tinyxml2#1084 ·
All issues in leethomason/tinyxml2
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nasa/fprime#6225 · 1 comment ·
Maintainers usually reply within 1 day
-
content good first issue
Difficulty 1/5 Under an hour Newbie friendliness 95/100
cpinitiative/usaco-guide#6699 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
codepointerapp/codepointer#231 ·
-
enhancement source/qq
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
metasequoiaime/msime-windows#1054 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
amnezia-vpn/amnezia-client#3297 · 1 comment ·
Maintainers usually reply within 1 day