Security: Add buffer verification in GenTextFile to prevent OOB heap reads#9121
Open
Ashutosh0x wants to merge 2 commits into
Open
Security: Add buffer verification in GenTextFile to prevent OOB heap reads#9121Ashutosh0x wants to merge 2 commits into
Ashutosh0x wants to merge 2 commits into
Conversation
Add bounds checking and null validation when deserializing .bfbs files: - Null-check object->fields() before dereferencing - Detect duplicate field IDs to prevent silent overwrites - Null-check individual field pointers in the loop - Null-check enum values() and included_filenames() pointers These checks prevent heap buffer overflow via maliciously crafted .bfbs files where field IDs exceed the fields array size. Fixes google#8932
GenText/GenTextFile trusts serialized field offsets and vector lengths without running the buffer through flatbuffers::Verifier first. A malformed binary with a corrupted vector length causes flatc --json to read past the buffer allocation, leaking heap contents into the JSON output or crashing with SIGSEGV. Add a Verifier check before buffer traversal in GenTextFile. If the buffer fails verification, return an error instead of proceeding with potentially dangerous reads. Fixes google#9051
Author
|
Hi @dbaileychess — this adds buffer verification in GenTextFile before traversal, fixing the OOB heap read reported in #9051. The root cause is that GenText trusts serialized vector lengths and field offsets from the binary without running the Verifier first. In release builds where FLATBUFFERS_ASSERT is stripped, a corrupted vector length causes flatc to silently read past the allocation and format heap contents as JSON — an information disclosure vector. The fix adds a single Verifier check before buffer traversal. If verification fails, GenTextFile returns an error string instead of proceeding with unsafe reads. Happy to adjust if needed! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix out-of-bounds heap read in
flatc --jsonby addingVerifiercheck before buffer traversal inGenTextFile.Vulnerability (#9051)
GenText()/GenTextFile()trusts serialized vector length fields without running the buffer throughflatbuffers::Verifier. A malformed binary with a corrupted vector length causesflatc --jsonto read past the buffer allocation, leaking heap contents into JSON output or crashing with SIGSEGV.Fix
Add
flatbuffers::Verifiercheck inGenTextFile()before callingGenText(). If verification fails, return an error instead of proceeding with potentially dangerous reads.Fixes #9051