terminate print_string_ptr output at the real end#1976
Conversation
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
1 similar comment
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
|
Seems that you just need to run clang-format-16 on loader/cJSON.c |
|
CI Vulkan-Loader build queued with queue ID 42044. |
|
CI Vulkan-Loader build # 3641 running. |
|
CI Vulkan-Loader build # 3641 passed. |
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
1 similar comment
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
b65b04b to
c9e4a9e
Compare
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
1 similar comment
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
3 participants
loader_cJSON_PrintPreallocated into a poisoned 64-byte buffer, string value "ab\ncd\ef":
The trailing 58 58 are two stale 'X' bytes from the caller buffer that end up inside the returned string.
print_string_ptr is the loader's fork of the cJSON string serialiser. A post-release change (commented at the escape switch) drops the leading backslash, so each escaped character writes one byte where the upstream budget reserved two, and five rather than six for a control-char uXXXX form. output_length still holds the upstream budget, so the copy loop stops short of it, yet the terminator is written at output[output_length] instead of at the real end. Whatever sits in the gap is read back by the following strlen/update_offset.
I only noticed it because the default path hides it: the print buffer is calloc'd and loader_realloc zeroes its grown tail, so the gap reads as zeros and strlen stops early. Two cases break that. PrintPreallocated writes into a caller-owned buffer that the header explicitly says the caller owns and need not zero. And loader_cJSON_Print grows through loader_realloc, whose app-allocator (pfnReallocation) branch does not zero the grown bytes, so a custom VkAllocationCallbacks leaves the gap as uninitialised heap. The stale bytes are appended to manifest-derived strings such as library_path and the layer name.
Fix terminates at the actual end (output_pointer). The added test prints an escaped string into a poisoned preallocated buffer; it shows the stale bytes before the change and a correctly terminated string after.