Repository navigation
Conversation
The safe traits AsMut/AsRef place no strict requirements on their implementations to provide a stable result, i.e. dereference to the same buffer when called multiple times. It's thus always wrong to recombine the results from two separate calls, especially address and length data when their Target is a slice. Instead, the buffer must be queried once and that slice be retained.
Two counts: the size of the buffer passed was not its length in bytes but its item count, making the kernel only fill it at most partially. The kernel enforces that the length is a multiple of the identifier size for keyrings (it won't partially write IDs with unclear endianess). More crucially, we'd trust the returned length when in reality the *actual* length of the keyring is returned and *not* the filled size as with a call to `read`. This would lead to a `Vec`'s length exceeding its capacity and thus an out of bounds reference in the later iteration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The method always returns the actual size of the underlying item. It was used instead similar to
readwhere it indicates the filled buffer size. Treating it as such, and in consequence trusting it to not exceed the passed-in capacity, is incorrect. See commit descriptions for details.I've add tests that utilize the Thread and Process keyring since I really don't like any of them potentially polluting my persistent session keyring during development. That just makes results of reading from either of these potentially flaky. I'd update the other tests but that's out of scope for a security relevant PR.
At least for
get_linksthe misunderstanding of the argument and result seem to have propagated into the test design. The capacity arguments are commonly the magic constant200, the selection of which masked both the out-of-bounds problem ofVec::set_len—due to most rings being much smaller—and the semantic disagreement of its unit being bytes and not keycounts. If there's a learning here you're in a better position to propagate it across the code base.Fixes: #22