{"action":"created","issue":{"url":"https://api.github.com/repos/ponylang/ponyc/issues/1427","repository_url":"https://api.github.com/repos/ponylang/ponyc","labels_url":"https://api.github.com/repos/ponylang/ponyc/issues/1427/labels{/name}","comments_url":"https://api.github.com/repos/ponylang/ponyc/issues/1427/comments","events_url":"https://api.github.com/repos/ponylang/ponyc/issues/1427/events","html_url":"https://github.com/ponylang/ponyc/issues/1427","id":190423825,"number":1427,"title":"String.truncate assumes the string is null-terminated","user":{"login":"Perelandric","id":1114646,"avatar_url":"https://avatars.githubusercontent.com/u/1114646?v=3","gravatar_id":"","url":"https://api.github.com/users/Perelandric","html_url":"https://github.com/Perelandric","followers_url":"https://api.github.com/users/Perelandric/followers","following_url":"https://api.github.com/users/Perelandric/following{/other_user}","gists_url":"https://api.github.com/users/Perelandric/gists{/gist_id}","starred_url":"https://api.github.com/users/Perelandric/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Perelandric/subscriptions","organizations_url":"https://api.github.com/users/Perelandric/orgs","repos_url":"https://api.github.com/users/Perelandric/repos","events_url":"https://api.github.com/users/Perelandric/events{/privacy}","received_events_url":"https://api.github.com/users/Perelandric/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-11-18T21:16:49Z","updated_at":"2016-11-24T09:10:32Z","closed_at":null,"body":"When a string is truncated to its own `.size()`, there should be no change in the string data, but a non-null-terminated string loses its last character.\r\n\r\n```pony\r\nlet s = String.from_iso_array(recover ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'] end)\r\n\r\nenv.out.print(s.string())\r\nenv.out.print(\"size: \" + s.size().string())\r\n\r\ns.truncate(s.size())\r\n\r\nenv.out.print(\"-------truncated to size-------\")\r\n\r\nenv.out.print(s.string())\r\nenv.out.print(\"size: \" + s.size().string())\r\n```\r\n\r\n```\r\nabcdefgh\r\nsize: 8\r\n-------truncated to size-------\r\nabcdefg\r\nsize: 7\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ponylang/ponyc/issues/comments/262725396","html_url":"https://github.com/ponylang/ponyc/issues/1427#issuecomment-262725396","issue_url":"https://api.github.com/repos/ponylang/ponyc/issues/1427","id":262725396,"user":{"login":"sylvanc","id":2785007,"avatar_url":"https://avatars.githubusercontent.com/u/2785007?v=3","gravatar_id":"","url":"https://api.github.com/users/sylvanc","html_url":"https://github.com/sylvanc","followers_url":"https://api.github.com/users/sylvanc/followers","following_url":"https://api.github.com/users/sylvanc/following{/other_user}","gists_url":"https://api.github.com/users/sylvanc/gists{/gist_id}","starred_url":"https://api.github.com/users/sylvanc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sylvanc/subscriptions","organizations_url":"https://api.github.com/users/sylvanc/orgs","repos_url":"https://api.github.com/users/sylvanc/repos","events_url":"https://api.github.com/users/sylvanc/events{/privacy}","received_events_url":"https://api.github.com/users/sylvanc/received_events","type":"User","site_admin":false},"created_at":"2016-11-24T09:10:32Z","updated_at":"2016-11-24T09:10:32Z","body":"There's another case in `builtin` that allows access to uninitialised memory:\r\n\r\n```pony\r\nlet memory = Array[U8].undefined(1 << 20)\r\n```\r\n\r\nHere, `memory` has access to a megabyte of uninitialised memory.\r\n\r\nBoth \"truncate to expand\" (which follows the same model as `truncate` for files on Linux) and \"undefined to expand\" result in exposing uninitialised memory, and for the same reason: performance. For example, creating a large array of numbers which will be filled in as the function proceeds, so the programmer doesn't want to write to the array twice.\r\n\r\nIt's quite different from Heartbleed (which allowed buffer over-reads to arbitrary memory locations), but it _does_ allow \"searching\" for previously deallocated memory. Or, rather, it doesn't inherently, but it's possible to imagine an application that could be exploited that way by user input causing repeated undefined array allocations of various sizes.\r\n\r\nThis is used in network code, reading blocks from files, reading from spawned processes, etc.\r\n\r\nI didn't present any solutions here :) It's an interesting and important trade-off. Anyone else have thoughts on this?"}}
{"actor":{"display_login":"sylvanc"}}