- Problem
The pointer version of remove() contains:
memmove(element,
element + 1,
size() - ((reinterpret_cast<uint8_t *>(element + 1) -
reinterpret_cast<uint8_t *>(base())) /
sizeof(T)));
[SmallTable::remove(T *)](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L275-L287)
The last value is the number of items left. but memmove() expects the number of bytes.
- Why is it bad?
If T is larger than one byte, the code copies too little data. This can damage the next firewall rules in the table.
This function is used here:
[Firewall use](
|
for (auto &tuple : table) |
|
{ |
|
if (tuple.localPort == localPort) |
|
{ |
|
table.remove(&tuple); |
|
break; |
)
- Suggested fix
Multiply the number of items by `sizeof(T).
The pointer version of
remove()contains:[SmallTable::remove(T *)](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L275-L287)The last value is the number of items left. but
memmove()expects the number of bytes.If
Tis larger than one byte, the code copies too little data. This can damage the next firewall rules in the table.This function is used here:
[Firewall use](
network-stack/lib/firewall/firewall.cc
Lines 625 to 630 in 58425e6
Multiply the number of items by `sizeof(T).