{"action":"created","issue":{"url":"https://api.github.com/repos/ocaml/ocaml/issues/814","repository_url":"https://api.github.com/repos/ocaml/ocaml","labels_url":"https://api.github.com/repos/ocaml/ocaml/issues/814/labels{/name}","comments_url":"https://api.github.com/repos/ocaml/ocaml/issues/814/comments","events_url":"https://api.github.com/repos/ocaml/ocaml/issues/814/events","html_url":"https://github.com/ocaml/ocaml/pull/814","id":177368874,"number":814,"title":"Fix broken bounds check in Buffer.add_substring","user":{"login":"yallop","id":1736496,"avatar_url":"https://avatars.githubusercontent.com/u/1736496?v=3","gravatar_id":"","url":"https://api.github.com/users/yallop","html_url":"https://github.com/yallop","followers_url":"https://api.github.com/users/yallop/followers","following_url":"https://api.github.com/users/yallop/following{/other_user}","gists_url":"https://api.github.com/users/yallop/gists{/gist_id}","starred_url":"https://api.github.com/users/yallop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yallop/subscriptions","organizations_url":"https://api.github.com/users/yallop/orgs","repos_url":"https://api.github.com/users/yallop/repos","events_url":"https://api.github.com/users/yallop/events{/privacy}","received_events_url":"https://api.github.com/users/yallop/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-16T08:18:15Z","updated_at":"2016-09-23T21:40:45Z","closed_at":"2016-09-16T08:23:55Z","pull_request":{"url":"https://api.github.com/repos/ocaml/ocaml/pulls/814","html_url":"https://github.com/ocaml/ocaml/pull/814","diff_url":"https://github.com/ocaml/ocaml/pull/814.diff","patch_url":"https://github.com/ocaml/ocaml/pull/814.patch"},"body":"This pull request is part of an occasional series on bounds checking and integer overflow. (Previous installments: #250, #805, #810.)\r\n\r\n### Summary\r\nThe bounds check in `Buffer.add_substring` does not handle overflow correctly.\r\n\r\n### Symptoms\r\n\r\nOut-of-bounds writes may be caught and reported only by a second check in `Bytes.blit_string`:\r\n```ocaml\r\n# let b = Buffer.create 2;;\r\nval b : Buffer.t = <abstr>\r\n# Buffer.add_string b \"ab\";;\r\n- : unit = ()\r\n# Buffer.add_substring  b \"cde\" 3 max_int;;\r\nException: Invalid_argument \"Bytes.blit_string\".\r\n```\r\n\r\nThere is an infinite loop in `Buffer.resize`:\r\n```ocaml\r\n# let b = Buffer.create 2;;\r\nval b : Buffer.t = <abstr>\r\n# Buffer.add_substring  b \"abc\" 3 max_int;;\r\n```\r\n\r\n\r\n### Post-fix\r\n\r\nBoth situations above are correctly detected and reported:\r\n\r\n```ocaml\r\n# let b = Buffer.create 2;;\r\nval b : Buffer.t = <abstr>\r\n# Buffer.add_string b \"ab\";;\r\n- : unit = ()\r\n# Buffer.add_substring  b \"cde\" 3 max_int;;\r\nException: Invalid_argument \"Buffer.add_substring/add_subbytes\".\r\n```\r\n\r\n```ocaml\r\n# let b = Buffer.create 2;;\r\nval b : Buffer.t = <abstr>\r\n# Buffer.add_substring  b \"abc\" 3 max_int;;\r\nException: Invalid_argument \"Buffer.add_substring/add_subbytes\".\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ocaml/ocaml/issues/comments/249309250","html_url":"https://github.com/ocaml/ocaml/pull/814#issuecomment-249309250","issue_url":"https://api.github.com/repos/ocaml/ocaml/issues/814","id":249309250,"user":{"login":"hannesm","id":228456,"avatar_url":"https://avatars.githubusercontent.com/u/228456?v=3","gravatar_id":"","url":"https://api.github.com/users/hannesm","html_url":"https://github.com/hannesm","followers_url":"https://api.github.com/users/hannesm/followers","following_url":"https://api.github.com/users/hannesm/following{/other_user}","gists_url":"https://api.github.com/users/hannesm/gists{/gist_id}","starred_url":"https://api.github.com/users/hannesm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hannesm/subscriptions","organizations_url":"https://api.github.com/users/hannesm/orgs","repos_url":"https://api.github.com/users/hannesm/repos","events_url":"https://api.github.com/users/hannesm/events{/privacy}","received_events_url":"https://api.github.com/users/hannesm/received_events","type":"User","site_admin":false},"created_at":"2016-09-23T21:40:44Z","updated_at":"2016-09-23T21:40:44Z","body":"Would it be possible to get this (as well as #810 and #815) into 4.04 (I know it is scheduled soon), these 3 potential integer overflows are potential security issues.  It would be great to have them fixed asap.  Also, the patches are rather small, local, and straightforward."}}
{"actor":{"display_login":"hannesm"}}