Skip to content

Segfault caused by off by one error in parsing source/destination #5594

@karenzshea

Description

@karenzshea

Sample crashing request (node osrm input):

{ coordinates:
   [ [ -121.94713392, 37.32329383 ],
     [ -121.94532930, 37.32341294 ] ],
  sources: [ 0, 1, 2 ],
  destinations: [ 1 ] }

https://github.com/Project-OSRM/osrm-backend/blob/master/include/nodejs/node_osrm_support.hpp#L1185

if (destination_value > params->coordinates.size())

In the sample request, this check technically passes, and then later in the table plugin, we try to access non-existent position 2 of the input coordinates array and segfault.

The same request but with sources: [ 0, 1, 2, 3 ] returns the error as expected, "Destination indices must be less than or equal to the number of coordinates"

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions