Skip to content

Security: Replace raw memcpy with safe std::vector insertion in WriteBytes - #209

Open
Admin135158 wants to merge 1 commit into
google:masterfrom
Admin135158:secure-store-bytes
Open

Admin135158 wants to merge 1 commit into
google:masterfrom
Admin135158:secure-store-bytes

Conversation

@Admin135158

Copy link
Copy Markdown

This PR addresses a potential memory safety issue in src/transform.cc. The original WriteBytes function used raw C-style pointer arithmetic and memcpy to append data to a std::vector<uint8_t>. Modern C++ static analyzers (and compilers with -Wunsafe-buffer-usage) flag this pattern because it bypasses the vector's internal bounds checking, risking out-of-bounds writes if the offset or length is miscalculated. This patch replaces the manual resize and memcpy logic with std::vector::insert(). This is a secure-by-design memory safety improvement that eliminates raw pointer arithmetic and leverages the C++ standard library's built-in bounds checking. (Note: I also updated the Makefile to use ar crs instead of ar crf for LLVM compatibility on Termux/Android environments).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant