Skip to content

[mono][aot] Avoid use of local buffer that could overflow #118985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

BrzVlad
Copy link
Member

@BrzVlad BrzVlad commented Aug 22, 2025

@Copilot Copilot AI review requested due to automatic review settings August 22, 2025 10:26
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR eliminates a potential buffer overflow vulnerability in the Mono AOT compiler by removing the use of a local buffer for symbol name handling. The change replaces sprintf operations that could exceed buffer bounds with direct usage of existing symbol strings.

Key Changes:

  • Removes local symbol buffer that was vulnerable to overflow
  • Eliminates unnecessary sprintf calls for symbol name copying
  • Uses acfg->got_symbol directly instead of copying to local buffer

@BrzVlad
Copy link
Member Author

BrzVlad commented Aug 22, 2025

@simonrozsival Looked over other uses of MAX_SYMBOL_SIZE throughout aot-compiler.c but couldn't find any other location that could potentially overflow. Thus decided against bumping the max symbol size.

Copy link
Member

@vitek-karas vitek-karas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

I don't understand why the code copied the strings before - makes no sense...

@BrzVlad
Copy link
Member Author

BrzVlad commented Aug 22, 2025

Looks good.

I don't understand why the code copied the strings before - makes no sense...

Long time ago AOT code had a pattern of always using strdup_printf for creating symbol names. I believe this was so that all pointers to strings were free-able. Code was refactored around, optimization was added in order to use local buffers instead, and this redundancy was leftover.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants