Commit 4437ae5
authored
[C#] Fix repeated group buffer overflow (#823)
On a repeated group in the WrapForEncode, the parentMessage.Limit has two purposes:
1. It is used as a buffer offset for the _dimensions helper Wrap method
2. The assignment to it has a side effect of checking that we do not exceed the underlying DirectBuffer's capacity
However notice that currently this assignment happens after writing to the _dimensions helper properties BlockLength and NumInGroup,
i.e. the writes are done *before* we check for buffer overflow.
Underneath these are direct writes to the byte* managed by the DirectBuffer, resulting in an unchecked, unsafe buffer overflow.
To fix this the Limit has to be increased right after the call to the _dimensions.Wrap, before writes to BlockLength and NumInGroup
The same occurs in the Decode method, only reading unsafe, invalid memory instead of writing to it.
Also fixed _actingVersion was being used before it's assigned in the Encode1 parent 627b450 commit 4437ae5
File tree
1 file changed
+3
-3
lines changed- sbe-tool/src/main/java/uk/co/real_logic/sbe/generation/csharp
1 file changed
+3
-3
lines changedLines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
207 | 207 | | |
208 | 208 | | |
209 | 209 | | |
| 210 | + | |
210 | 211 | | |
211 | 212 | | |
212 | 213 | | |
213 | 214 | | |
214 | | - | |
215 | 215 | | |
216 | 216 | | |
217 | 217 | | |
| |||
232 | 232 | | |
233 | 233 | | |
234 | 234 | | |
235 | | - | |
| 235 | + | |
| 236 | + | |
236 | 237 | | |
237 | 238 | | |
238 | 239 | | |
239 | 240 | | |
240 | 241 | | |
241 | 242 | | |
242 | | - | |
243 | 243 | | |
244 | 244 | | |
245 | 245 | | |
| |||
0 commit comments