8000 Release 1.0.1: security: ByteBuffer: fix heap buffer overflow on slice realloc · imcotton/swift-nio · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

1.0.1

Motivation:

ByteBuffer had a very bad (exploitable!) security vulnerability if the
following conditions are all true:

- user writes to a ByteBuffer which is a slice (slice.lowerBound != 0)
- the slice is uniquely referenced (ie. the buffer that it was sliced
  from is gone)
- the write triggers a re-allocation

Then the slice is actually _larger_ than the overall available capacity
so another write to said ByteBuffer could end up out of bounds.

Modifications:

- fixed slice reallocation

Result:

- fixed security vulnerability
Assets 2
Loading
0