[jira] [Updated] (XERCESC-2253) Undefined behavior on ElemStack and NamespaceScope

     [ https://issues.apache.org/jira/browse/XERCESC-2253?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Diego Ortín updated XERCESC-2253:
---------------------------------
    Description: 
When running programs that use xerces-c with the Undefined Behavior Sanitizer (ubsan), undefined behavior is detected in {{ElemStack::expandStack}} and {{NamespaceScope::expandMap}}. Both instances are due to memcpy being called with {{NULL}} as one of its parameters when {{toExpand->fMap}} is {{NULL}}, which works (the size parameter is 0) but is undefined behavior.

This is fixed by doing a simple check for null before calling {{memcpy}}. If the object we wanted to copy from was null, we do not copy at all and the result is the same. This avoids the UBSan being triggered, and potential issues with compiler optimizations (as both pointer arguments to {{memcpy}} are marked as {{__nonnull}})

I can send a simple patch that fixes this.

  was:
When running programs that use xerces-c with the Undefined Behavior Sanitizer (ubsan), undefined behavior is detected in {{ElemStack::expandStack}} and {{{}NamespaceScope::expandMap{}}}. Both instances are due to memcpy being called with {{NULL }}as one of its parameters when {{toExpand->fMap}} is {{{}NULL{}}}, which works (the size parameter is 0) but is undefined behavior.

This is fixed by doing a simple check for null before calling {{{}{{memcpy}}{}}}. If the object we wanted to copy from was null, we do not copy at all and the result is the same. This avoids the UBSan being triggered, and potential issues with compiler optimizations (as both pointer arguments to {{memcpy}} are marked as {{{}__nonnull{}}})

I can send a simple patch that fixes this.


> Undefined behavior on ElemStack and NamespaceScope
> --------------------------------------------------
>
>                 Key: XERCESC-2253
>                 URL: https://issues.apache.org/jira/browse/XERCESC-2253
>             Project: Xerces-C++
>          Issue Type: Bug
>          Components: Miscellaneous
>    Affects Versions: 3.2.5
>         Environment: gcc-12, C++17
>            Reporter: Diego Ortín
>            Priority: Major
>
> When running programs that use xerces-c with the Undefined Behavior Sanitizer (ubsan), undefined behavior is detected in {{ElemStack::expandStack}} and {{NamespaceScope::expandMap}}. Both instances are due to memcpy being called with {{NULL}} as one of its parameters when {{toExpand->fMap}} is {{NULL}}, which works (the size parameter is 0) but is undefined behavior.
> This is fixed by doing a simple check for null before calling {{memcpy}}. If the object we wanted to copy from was null, we do not copy at all and the result is the same. This avoids the UBSan being triggered, and potential issues with compiler optimizations (as both pointer arguments to {{memcpy}} are marked as {{__nonnull}})
> I can send a simple patch that fixes this.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)