Skip to content

Guard allocation-size calculation in ctest_sprintf #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
orbisai0security wants to merge 2 commits into
base: master
Choose a base branch
from
+9 −3
Open

Guard allocation-size calculation in ctest_sprintf #330

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2aee644
fix: V-001 security vulnerability
orbisai0security May 16, 2026
8169a79
fix: guard allocation-size calculation against signed int overflow in…
orbisai0security Jun 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions src/ctest.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@
#include "ctest.h"
#include "c_logging/logger.h"

#include <limits.h> // for INT_MAX, SIZE_MAX

#if defined _MSC_VER && !defined(WINCE)
#include <limits.h> // for SIZE_MAX
#include "windows.h"
#endif

Expand Down Expand Up @@ -618,17 +619,22 @@ static char* ctest_vsprintf_char(const char* format, va_list va)
LogError("failure in vsnprintf, format=%s, va_clone=%p);", format, (void*)&va_clone);
result = NULL;
}
else if (neededSize == INT_MAX)
{
LogError("overflow in allocation size calculation, neededSize=INT_MAX");
result = NULL;
}
else
{
result = malloc(neededSize + 1);
result = malloc((size_t)neededSize + 1);
if (result == NULL)
Copy link
Copy Markdown
Contributor

@mattdurak mattdurak Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description claims that the malloc on line 623 is not checked for NULL, the check is here on line 624.

Copy link
Copy Markdown
Author

@orbisai0security orbisai0security Jun 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right — the PR description was wrong. The existing code does check malloc for NULL immediately after allocation.

I've reframed this as a narrower defensive integer-overflow fix: guarding the neededSize + 1 allocation-size calculation before the addition is evaluated. I'll update the PR title/description and patch accordingly. If you think this edge case is too theoretical for this project, I'm also happy to close it.

Copy link
Copy Markdown
Author

@orbisai0security orbisai0security Jun 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You’re right, the PR description was wrong. The existing code does check malloc for NULL immediately after allocation.

I’ve reframed this as a narrower defensive integer-overflow fix: guarding the neededSize + 1 allocation-size calculation before the addition is evaluated. I’ve updated the PR title/description and patched accordingly.

{
LogError("failure in malloc");
/*return as is*/
}
else
{
if (vsnprintf(result, neededSize + 1, format, va) != neededSize)
if (vsnprintf(result, (size_t)neededSize + 1, format, va) != neededSize)
{
LogError("inconsistent vsnprintf behavior format, neededSize=%d + 1, format=%s, va=%p", neededSize, format, (void*)&va);
free(result);
Expand Down