-
Notifications
You must be signed in to change notification settings - Fork 65
Description
Describe the bug
Line 1592 in d294acf
char *pe = pb + s – 1; |
If s
is zero, then pe
is set just below pb
-- or in case pb
is zero, we wrap around 0 downwards, to the maximum possible pointer value. In either of those cases, all the subsequent cmse_TT*
invocations get bogus pe
values.
Arguably, if the caller intends to access zero bytes, we should immediately fail, or immediately validate, the intent (I could see arguments for either outcome). What we should probably not do is call cmse_TT*
at all.
Screenshots
If applicable, add screenshots to help explain your problem. This is
useful for layout problems in the PDF or HTML pages.
Our commitment
We will work to solve the bug report in time for the upcoming
release. However, we would like to encourage you to submit the fix
yourself, if possible. If you intend to do so and this is your first
contribution, we recommend reading our contribution
guidelines.