Out-of-bounds memory access in memcpy_downward when in_use sizes exceed buffer sizes

[paulquiring]

The current implementation of

flatbuffers/include/flatbuffers/allocator.h

Line 57 in 81edeb1

void memcpy_downward(uint8_t* old_p, size_t old_size, uint8_t* new_p,

performs no out-of-bounds checks. Without bounds checks writes past buffer boundaries are possible which can lead to memory corruption.

Adding the following asserts will protect against misuse.

void memcpy_downward(uint8_t* old_p, size_t old_size, uint8_t* new_p,
                      size_t new_size, size_t in_use_back, size_t in_use_front) {
     FLATBUFFERS_ASSERT(in_use_back <= old_size);
     FLATBUFFERS_ASSERT(in_use_back <= new_size);
     memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back,
         in_use_back);
     FLATBUFFERS_ASSERT(in_use_front <= old_size);
     FLATBUFFERS_ASSERT(in_use_front <= new_size);
     memcpy(new_p, old_p, in_use_front);
}