Skip to content

Possible buffer overflow in TF1 / TString #8136

Closed
#8426
Closed
Possible buffer overflow in TF1 / TString#8136
#8426
Assignees
AdvaitDhingra
Labels
bugin:Core Libraries
@hageboeck

Description

@hageboeck
hageboeck
opened on May 10, 2021

Address sanitizer uncovered an unprotected memcpy happening here:

root/core/base/src/TString.cxx

Lines 127 to 136 in 08cbc9b

TString::TString(const char *cs, Ssiz_t n)
{
if (n < 0) {
Error("TString::TString", "Negative length!");
Zero();
return;
}
char *data = Init(n, n);
memcpy(data, cs, n);
}

Invoked from here:

root/hist/hist/src/TF1.cxx

Line 535 in 08cbc9b

if (TString(formula, 5) == "CONV(" && formula[strlen(formula) - 1] == ')') {

Note that it's always 5 characters being copied from the incoming string formula.

Metadata

Metadata

Assignees

Labels

bugin:Core Libraries

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions