Skip to content

Commit 4437ae5

Browse files
authored
[C#] Fix repeated group buffer overflow (#823)
On a repeated group in the WrapForEncode, the parentMessage.Limit has two purposes: 1. It is used as a buffer offset for the _dimensions helper Wrap method 2. The assignment to it has a side effect of checking that we do not exceed the underlying DirectBuffer's capacity However notice that currently this assignment happens after writing to the _dimensions helper properties BlockLength and NumInGroup, i.e. the writes are done *before* we check for buffer overflow. Underneath these are direct writes to the byte* managed by the DirectBuffer, resulting in an unchecked, unsafe buffer overflow. To fix this the Limit has to be increased right after the call to the _dimensions.Wrap, before writes to BlockLength and NumInGroup The same occurs in the Decode method, only reading unsafe, invalid memory instead of writing to it. Also fixed _actingVersion was being used before it's assigned in the Encode
1 parent 627b450 commit 4437ae5

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

sbe-tool/src/main/java/uk/co/real_logic/sbe/generation/csharp/CSharpGenerator.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -207,11 +207,11 @@ private void generateGroupClassHeader(
207207
indent + INDENT + INDENT + "_parentMessage = parentMessage;\n" +
208208
indent + INDENT + INDENT + "_buffer = buffer;\n" +
209209
indent + INDENT + INDENT + "_dimensions.Wrap(buffer, parentMessage.Limit, actingVersion);\n" +
210+
indent + INDENT + INDENT + "_parentMessage.Limit = parentMessage.Limit + SbeHeaderSize;\n" +
210211
indent + INDENT + INDENT + "_blockLength = _dimensions.BlockLength;\n" +
211212
indent + INDENT + INDENT + "_count = (int) _dimensions.NumInGroup;\n" + // cast safety checked above
212213
indent + INDENT + INDENT + "_actingVersion = actingVersion;\n" +
213214
indent + INDENT + INDENT + "_index = 0;\n" +
214-
indent + INDENT + INDENT + "_parentMessage.Limit = parentMessage.Limit + SbeHeaderSize;\n" +
215215
indent + INDENT + "}\n",
216216
parentMessageClassName));
217217

@@ -232,14 +232,14 @@ private void generateGroupClassHeader(
232232
indent + INDENT + INDENT + "}\n\n" +
233233
indent + INDENT + INDENT + "_parentMessage = parentMessage;\n" +
234234
indent + INDENT + INDENT + "_buffer = buffer;\n" +
235-
indent + INDENT + INDENT + "_dimensions.Wrap(buffer, parentMessage.Limit, _actingVersion);\n" +
235+
indent + INDENT + INDENT + "_dimensions.Wrap(buffer, parentMessage.Limit, SchemaVersion);\n" +
236+
indent + INDENT + INDENT + "parentMessage.Limit = parentMessage.Limit + SbeHeaderSize;\n" +
236237
indent + INDENT + INDENT + "_dimensions.BlockLength = SbeBlockLength;\n" +
237238
indent + INDENT + INDENT + "_dimensions.NumInGroup = (%5$s) count;\n" +
238239
indent + INDENT + INDENT + "_index = 0;\n" +
239240
indent + INDENT + INDENT + "_count = count;\n" +
240241
indent + INDENT + INDENT + "_blockLength = SbeBlockLength;\n" +
241242
indent + INDENT + INDENT + "_actingVersion = SchemaVersion;\n" +
242-
indent + INDENT + INDENT + "parentMessage.Limit = parentMessage.Limit + SbeHeaderSize;\n" +
243243
indent + INDENT + "}\n",
244244
parentMessageClassName,
245245
numInGroupToken.encoding().applicableMinValue().longValue(),

0 commit comments

Comments
 (0)