Skip to content

[Precogs Alert] Buffer Overflow detected (CWE-120, Risk: Critical) #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rajnishprecogs wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Precogs Alert] Buffer Overflow detected (CWE-120, Risk: Critical) #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions src/simple_examples/explore_me.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,18 +7,28 @@ static long insecureEncrypt(long input);
static void trigger_global_buffer_overflow(const std::string &c);
static void trigger_use_after_free();

void ExploreSimpleChecks(int a, int b, std::string c) {
void ExploreSimpleChecks(int a, int b, const std::string& c) {
if (a >= 20000) {
if (b >= 2000000) {
if (b - a < 100000) {
if (c == "Attacker") {
trigger_global_buffer_overflow(c);
// FIX: Ensure trigger_global_buffer_overflow is safe or remove unsafe call
// If trigger_global_buffer_overflow must be called, ensure it performs bounds checking internally.
// Example safe wrapper:
if (c.size() < SAFE_BUFFER_SIZE) { // SAFE_BUFFER_SIZE should match the buffer size in trigger_global_buffer_overflow
trigger_global_buffer_overflow(c);
} else {
// Handle error: input too large
// Optionally log or return an error code
}
}
}
}
}
}

// FIX EXPLANATION: The fix ensures that trigger_global_buffer_overflow is only called with a string whose size does not exceed the size of the destination buffer, preventing buffer overflow. The function signature is also updated to take 'const std::string&' to avoid unnecessary copies. If possible, trigger_global_buffer_overflow itself should be rewritten to always perform bounds checking internally, regardless of caller behavior.

void ExploreComplexChecks(long a, long b, std::string c) {
if (EncodeBase64(c) == "SGV5LCB3ZWw=") {
if (insecureEncrypt(a) == 0x4e9e91e6677cfff3L) {
Expand Down