Do not call memcpy with nullptr in SimpleBuffer::Read() and Write().
"If either dest or src is an invalid or null pointer, the behavior is undefined,
even if count is zero" according to
https://en.cppreference.com/w/cpp/string/byte/memcpy.
In Write(), if `size` is positive, then Reserve() guarantees that destination
will never be nullptr. If source is nullptr and `size` is zero, then the newly
added early return prevents the memcpy call. If source is nullptr and `size` is
not zero, that is the caller's fault.
In Read(), if `bytes` is nullptr and `size` is zero, then a newly added early
return prevents the memcpy call. If `bytes` is nullptr and `size` is not zero,
that is the caller's fault. If `read_ptr` is nullptr, then `read_size` will be
zero, triggering the newly added early return path.
This is covered by existing tests in UBSAN mode, which are never actually ran in
UBSAN mode, but will be on Envoy CI soon.
PiperOrigin-RevId: 449057984
diff --git a/quiche/balsa/simple_buffer.cc b/quiche/balsa/simple_buffer.cc
index c32f0f0..756c7da 100644
--- a/quiche/balsa/simple_buffer.cc
+++ b/quiche/balsa/simple_buffer.cc
@@ -20,8 +20,8 @@
////////////////////////////////////////////////////////////////////////////////
int SimpleBuffer::Write(const char* bytes, int size) {
- if (size < 0) {
- QUICHE_BUG(simple_buffer_write_negative_size)
+ if (size <= 0) {
+ QUICHE_BUG_IF(simple_buffer_write_negative_size, size < 0)
<< "size must not be negative: " << size;
return 0;
}
@@ -45,6 +45,10 @@
int read_size = 0;
GetReadablePtr(&read_ptr, &read_size);
read_size = std::min(read_size, size);
+ if (read_size == 0) {
+ return 0;
+ }
+
memcpy(bytes, read_ptr, read_size);
AdvanceReadablePtr(read_size);
return read_size;
