Skip to content

Harden public C and C++ APIs and Source/Sink against null pointers and underflow - #268

Open
filtede98 wants to merge 1 commit into
google:mainfrom
filtede98:guard-null-and-bounds-safety
Open

filtede98 wants to merge 1 commit into
google:mainfrom
filtede98:guard-null-and-bounds-safety

Conversation

@filtede98

Copy link
Copy Markdown

Summary

This patch hardens Snappy public C API entry points, C++ compression and decompression routines, and Source and Sink implementations against null pointer dereferences and unsigned integer underflow.

Detailed Changes

  1. Public C API (snappy-c.cc):

    • Added validation in snappy_compress, snappy_compress_with_level, snappy_uncompress, snappy_uncompressed_length, and snappy_validate_compressed_buffer ensuring that input, output buffer, and length pointers are valid when lengths are positive.
    • Return SNAPPY_INVALID_INPUT when invalid null pointers are supplied.
  2. Source and Sink Safety (snappy-sinksource.h, snappy-sinksource.cc):

    • Prevent unsigned underflow in ByteArraySource::Skip(size_t n) by clamping
      to left_.
    • Initialize left_ to 0 in ByteArraySource constructor if the underlying data pointer is null.
    • Guard len pointer in ByteArraySource::Peek(size_t* len) before assignment.
    • Guard deleter function pointer before invocation and �llocated_size pointer before assignment in Sink::AppendAndTakeOwnership, Sink::GetAppendBufferVariable, UncheckedByteArraySink::AppendAndTakeOwnership, and UncheckedByteArraySink::GetAppendBufferVariable.
  3. C++ API Pointer Guards (snappy.cc):

    • Added null checks in GetUncompressedLength (both string and Source* overloads) returning false on null pointers.
    • Added null checks in Compress and InternalCompress returning 0 when reader, writer, or context pointer is null.
    • Added null checks in RawCompress overloads ensuring *compressed_length is cleared to 0 and execution safely returns when invalid pointers are passed.
    • Added null checks in RawUncompress, Uncompress, and UncompressAsMuchAsPossible ensuring safe returns without dereferencing null pointers.
  4. Unit Test Coverage (snappy_unittest.cc):

    • Added NullPointerAndBoundsGuards test verifying safe returns and error codes across C and C++ entry points when passed null pointers or excessive skip counts.

…d underflow

Add defensive pointer and bounds validation across public C API functions,
C++ compression/decompression routines, and Source/Sink implementations.

Specifically:
* Validate input, output, and length pointers in snappy-c public entry
  points (snappy_compress, snappy_compress_with_level, snappy_uncompress,
  snappy_uncompressed_length, snappy_validate_compressed_buffer), returning
  SNAPPY_INVALID_INPUT on null pointer arguments.
* Prevent unsigned integer underflow in ByteArraySource::Skip by clamping
  the skip count to the available byte count.
* Initialize left_ to 0 in ByteArraySource constructor when the data pointer
  is null.
* Validate function pointer deleter before invocation and allocated_size
  pointer before assignment in Sink and UncheckedByteArraySink.
* Guard against null Source, Sink, CompressionContext, buffer, and length
  pointers in C++ entry points (Compress, RawCompress, RawUncompress,
  Uncompress, UncompressAsMuchAsPossible, GetUncompressedLength).
* Add NullPointerAndBoundsGuards unit test in snappy_unittest.cc verifying
  safe error handling across all guarded entry points.

Signed-off-by: Filippo Tedeschi <filippotedeschi98@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant