iovisor / ubpf / 21422523864

78%

push

github

Fix integer overflow vulnerabilities in bounds_check (#720)

* Add integer overflow checks to bounds_check function

- Check for negative size values
- Check for overflow in access_start + size calculation
- Check for overflow in stack_start + stack_len calculation
- Check for overflow in mem_start + mem_len calculation
- Add test case for integer overflow scenario

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Address code review feedback - improve mem NULL handling

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Add type cast for bounds check function call

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Fix goto jumping over variable initializers and relax test pattern

- Move all variable declarations before any goto statements to avoid -Wjump-misses-init errors
- Use validity flags (stack_valid, mem_valid) to track which regions are safe to check
- Relax test error pattern from specific hex format to .* for portability

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Fix pointer arithmetic overflow at call sites

Addresses comment 2733624376: The macros BOUNDS_CHECK_LOAD and BOUNDS_CHECK_STORE
now perform address computation safely in uint64_t space with overflow detection
before casting to void* and passing to bounds_check(). This prevents overflow in
the expression (char*)reg[inst.src] + inst.offset from bypassing the overflow
checks in bounds_check().

The fix handles both positive and negative offsets correctly:
- For positive offsets: check if base_addr + offset would overflow
- For negative offsets: check if base_addr - abs(offset) would underflow

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Use computed safe address in memory operations

Extract address computation into helper macro and use the safely computed
address (_eff_addr) in all memory load/store operations instead of reco... (continued)

46 of 63 new or added lines in 1 file covered. (73.02%)

5965 of 7646 relevant lines covered (78.01%)

389599.79 hits per line