From ab0e469096c832f414d6ffe89f52e6fe2937ccdb Mon Sep 17 00:00:00 2001 From: "Quiring Paul (ETAS-ECM/XPC-Fe2)" Date: Wed, 1 Jul 2026 17:33:08 +0200 Subject: [PATCH 1/2] Add out of bounds checks_in_memcpy downward --- include/flatbuffers/allocator.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/include/flatbuffers/allocator.h b/include/flatbuffers/allocator.h index d451818568..a48cda639d 100644 --- a/include/flatbuffers/allocator.h +++ b/include/flatbuffers/allocator.h @@ -57,9 +57,13 @@ class Allocator { void memcpy_downward(uint8_t* old_p, size_t old_size, uint8_t* new_p, size_t new_size, size_t in_use_back, size_t in_use_front) { - memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back, - in_use_back); - memcpy(new_p, old_p, in_use_front); + FLATBUFFERS_ASSERT(in_use_back <= old_size); + FLATBUFFERS_ASSERT(in_use_back <= new_size); + memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back, + in_use_back); + FLATBUFFERS_ASSERT(in_use_front <= old_size); + FLATBUFFERS_ASSERT(in_use_front <= new_size); + memcpy(new_p, old_p, in_use_front); } }; From f5d1d77be122b38444c68a89d6ffd2a6690e5596 Mon Sep 17 00:00:00 2001 From: "Quiring Paul (ETAS-ECM/XPC-Fe2)" Date: Wed, 1 Jul 2026 17:46:18 +0200 Subject: [PATCH 2/2] after scripts/clang-format-git.sh --- include/flatbuffers/allocator.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/include/flatbuffers/allocator.h b/include/flatbuffers/allocator.h index a48cda639d..e1c8fa7963 100644 --- a/include/flatbuffers/allocator.h +++ b/include/flatbuffers/allocator.h @@ -57,13 +57,13 @@ class Allocator { void memcpy_downward(uint8_t* old_p, size_t old_size, uint8_t* new_p, size_t new_size, size_t in_use_back, size_t in_use_front) { - FLATBUFFERS_ASSERT(in_use_back <= old_size); - FLATBUFFERS_ASSERT(in_use_back <= new_size); - memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back, - in_use_back); - FLATBUFFERS_ASSERT(in_use_front <= old_size); - FLATBUFFERS_ASSERT(in_use_front <= new_size); - memcpy(new_p, old_p, in_use_front); + FLATBUFFERS_ASSERT(in_use_back <= old_size); + FLATBUFFERS_ASSERT(in_use_back <= new_size); + memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back, + in_use_back); + FLATBUFFERS_ASSERT(in_use_front <= old_size); + FLATBUFFERS_ASSERT(in_use_front <= new_size); + memcpy(new_p, old_p, in_use_front); } };