The Gandiva mask stubs walk a utf8 string with utf8proc_iterate, but pass the total data_len as the remaining-byte count instead of data_len - bytes_read even though the pointer has already advanced:
gdv_mask_first_n_utf8_int32gdv_mask_last_n_utf8_int32mask_utf8_utf8_utf8_utf8
utf8proc_iterate(str, strlen, ...) reads up to strlen bytes from str. With str = data + bytes_read and strlen = data_len, a truncated trailing multi-byte glyph (for example a lead byte 0xF0 as the final byte of an exactly-sized value buffer) makes utf8proc read continuation bytes past data + data_len.
This is reachable from mask() / mask_first_n() / mask_last_n() on untrusted string data whose value buffer is exactly sized. Passing the true remaining length lets utf8proc report the truncated glyph instead of over-reading.
Component(s)
C++, Gandiva
The Gandiva mask stubs walk a utf8 string with
utf8proc_iterate, but pass the totaldata_lenas the remaining-byte count instead ofdata_len - bytes_readeven though the pointer has already advanced:gdv_mask_first_n_utf8_int32gdv_mask_last_n_utf8_int32mask_utf8_utf8_utf8_utf8utf8proc_iterate(str, strlen, ...)reads up tostrlenbytes fromstr. Withstr = data + bytes_readandstrlen = data_len, a truncated trailing multi-byte glyph (for example a lead byte0xF0as the final byte of an exactly-sized value buffer) makes utf8proc read continuation bytes pastdata + data_len.This is reachable from
mask()/mask_first_n()/mask_last_n()on untrusted string data whose value buffer is exactly sized. Passing the true remaining length lets utf8proc report the truncated glyph instead of over-reading.Component(s)
C++, Gandiva