squidfunk / protobluff

A modular Protocol Buffers implementation for C

Home Page:https://squidfunk.github.io/protobluff/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

buffer size not being cleared

JesseChisholm opened this issue · comments

In src/core/buffer.c circa line 136, in method pb_buffer_destroy, the buffer->data is set to NULL, but the buffer->size is not set to zero.

The issue is that if this same buffer is later given to pb_buffer_grow to add some space, the old non-zero size is used.

Also, pb_buffer_empty(b) on such a buffer will return false.

This would crash even before. You shouldn't hand a destroyed (= freed) buffer to pb_buffer_grow because it will return NULL for the zero-copy allocator and would crash for every other allocator because it was reset in line 138. The idea was that after you pass something to a destroy function, you should consider that data garbage, even though it's still on the stack. Clearing is an additional performance penalty (which is really small, yes), but this was what I had in mind when designing this.

However, to be safe, I agree that we should just reset the size because that would make the buffer invalid which will make it safer passing it down to other functions after destroying it. I will provide a fix.

Fixed and released as version 1.0.3.