Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@serpedon
Copy link
Contributor

@serpedon serpedon commented Dec 19, 2020

The archives use the memory address pointed by the shared_ptr as a
unique id which must not be reused during lifetime of the archive.
Therefore, the archives stores a copy of it.
This problem was also reported as CVE-2020-11105 and #636. This should fix #636.

My line of though was the following:
Correct usage of std::shared_ptr in Cereal requires that the shared_ptr is still valid at the point when all serialization occurs, usually at the end of the lifetime of the archive. It was suggested to document this constraint to the user, but since we are already dealing with smart pointers, I though, hey, let's implement this constraint by storing our own copy of the std::shared_ptr.

…ent the shared_ptr to be freed to early.

The archives use the memory address pointed by the shared_ptr as a
unique id which must not be reused during lifetime of the archive.
Therefore, the archives stores a copy of it.
This problem was also reported as CVE-2020-11105.
@serpedon serpedon marked this pull request as ready for review December 19, 2020 18:56
@serpedon serpedon changed the title Store a copy of each serialized shared_ptr within the archive to prevent the shared_ptr to be freed to early. CVE-2020-11105: Store a copy of each serialized shared_ptr within the archive to prevent the shared_ptr to be freed to early. Dec 19, 2020
@AzothAmmo
Copy link
Contributor

Looks good, I'm trying to figure out why the Travis CI did not run - will merge after that is sorted.

@AzothAmmo AzothAmmo added the bug label Dec 21, 2020
@AzothAmmo AzothAmmo added this to the v1.3.1 milestone Dec 21, 2020
@InBetweenNames
Copy link
Contributor

Looks like all checks have passed -- can we get this merged?

@AzothAmmo AzothAmmo merged commit f27c12d into USCiLab:master Feb 1, 2021
arximboldi pushed a commit to arximboldi/cereal that referenced this pull request Sep 7, 2021
…ent the shared_ptr to be freed to early. (USCiLab#667)

The archives use the memory address pointed by the shared_ptr as a
unique id which must not be reused during lifetime of the archive.
Therefore, the archives stores a copy of it.
This problem was also reported as CVE-2020-11105.
AzothAmmo pushed a commit to AzothAmmo/cereal that referenced this pull request Nov 28, 2021
…ent the shared_ptr to be freed to early. (USCiLab#667)

The archives use the memory address pointed by the shared_ptr as a
unique id which must not be reused during lifetime of the archive.
Therefore, the archives stores a copy of it.
This problem was also reported as CVE-2020-11105.
julianharbarth added a commit to motis-project/cereal that referenced this pull request Mar 14, 2023
* Fix json.hpp compilation issue when int32_t is a long (USCiLab#621)

When testing whether or not to define a saveValue() overload
for long, test the actual set of types implemented.

* [cpp20] explicitly capture 'this' as copy (USCiLab#640)

implicit 'this' capture is deprecated in C++20

* Fix rapidjson for Clang 10 (USCiLab#645)

Based on Tencent/rapidjson#1679
Addresses USCiLab#631

* Fixes to prevent clang-diagnostic errors (USCiLab#643)

* Fixes to prevent clang-diagnostic when running clang-tidy with Microsoft Visual Studio cmake projects.

* Used boolean rather than bitwise operator.

* cleanup cmake files to be a little more moderen (USCiLab#659)

* cleanup cmake files to be a little more moderen

keep the source tree free of build artifacts
cmakelint the cmake files too

* fix cmake setup errors on CI

fix APPLE clang builds too

* CI needs support for realy history cmake V3.6

fix typo in cmake files using add_test() commnds

* One step more to use modern cmake

Prevent to modifiy compile and linker FLAGS and to set global includes
pathes

* fix CI build problems with older cmake versions

prepare cleanup cmake list file

* final cleanup

use Config.cmake.in and install hole cmake config files

* Fix cpp17 PORTABILITY_TEST linker problem

add missed target_link_libraries()

* hopefully prevent windows test problems

* Store a copy of each serialized shared_ptr within the archive to prevent the shared_ptr to be freed to early. (USCiLab#667)

The archives use the memory address pointed by the shared_ptr as a
unique id which must not be reused during lifetime of the archive.
Therefore, the archives stores a copy of it.
This problem was also reported as CVE-2020-11105.

* add license files for components of cereal

Signed-off-by: Adam Miartus <[email protected]>

* Update README.md

Fix link to main website

* Catch short documents in JSON input

When reading unnamed fields from JSON input, the member/value iterators
are incremented blind without checking if the end of the iterator has
been reached.

Record the size so that this can be checked against the current position
to ensure reading doesn't walk off the end of the iterator.

* C++17: use inline globals for StaticObjects

This prevents multiple definition errors in Clang,
and also stops dllexporting functions with internal
linkage.  Degrades gracefully when C++17 is not
present.

Fix USCiLab#595
Fix USCiLab#652
Fix USCiLab#582
Fix USCiLab#643

* Use std::variant::emplace when loading

* Use std::optional::emplace() when loading to construct and load the contained value directly in place

* Fix itsNextName not clearing when not found

An issue exists when loading vectors of objects where, if the last nvp of
the previous object does not exist in the json file, the itsNextName
variable within the json serializer is not cleared. This causes the vector
serializer to search for that name next (when it should be searching for a
nameless object.) The json serializer then throws during the named search.

Mild reworking of itsNextName solution

* Add github actions workflow

use docker containers
remove sudo
install software-properties-common
update before trying install
install wget
cmake and make
install cmake from pip
add apt-transport-https
Use llvm xenial
Fix clang package name
Fix boost with gcc<5
verbose compile
skip boost for gcc<5
macos test
skip boost for macos
test different xcode compilers
use new cmake syntax for selecting platform
no xcode 10 installed
Rename tests

* Update doctest to 2.4.6 dev + local fixes slated for upstream

* Update appveyor to build with MSVC 2022 and fix boost

* Fixed loading of std::vector<bool>

We should use auto && instead of auto if we want to modify v inside the for loop.

* Update license to match BSD template

* Update doctest to 2.4.7, update CI, add badges

Updates doctest and fixes issues with g++4.7 and MSVC2013 doctest
builds.

Adds new CI targets for g++ 9 and 10, clang 9 through 12.

Adds CI badges for github actions.

* Use GNUInstallDirs instead of hard wiring install directories

On a multilib setup cmake files should go into lib64.

* Update version to 1.3.1

* Make doxygen docs reproducible

* Add CMake options for building doc and sandbox

relates USCiLab#739

* Correct patch version for 1.3.2

* Fix long long json serialization (USCiLab#728)

* Fix long long json serialization

* Update pod.hpp

* Update .gitignore

`.vs/` folder is created by Visual Studio and it is not needed.

* `ST` renamed to `AlignedStorage`

* Remove extra ; after member function definition

Triggered by -Wextra-semi.

* add string_view to json archive

---------

Signed-off-by: Adam Miartus <[email protected]>
Co-authored-by: Bernard Blackham <[email protected]>
Co-authored-by: Łukasz Gemborowski <[email protected]>
Co-authored-by: groscoe2 <[email protected]>
Co-authored-by: John Alexander <[email protected]>
Co-authored-by: Claus Klein <[email protected]>
Co-authored-by: Michael Walz <[email protected]>
Co-authored-by: Adam Miartus <[email protected]>
Co-authored-by: Shane Grant <[email protected]>
Co-authored-by: John Keeping <[email protected]>
Co-authored-by: Shane Peelar <[email protected]>
Co-authored-by: logan <[email protected]>
Co-authored-by: Gary Heckman <[email protected]>
Co-authored-by: Isuru Fernando <[email protected]>
Co-authored-by: Darred <[email protected]>
Co-authored-by: Anton Blanchard <[email protected]>
Co-authored-by: Michael R. Crusoe <[email protected]>
Co-authored-by: CHP <[email protected]>
Co-authored-by: Luca Ciucci <[email protected]>
Co-authored-by: Jan Niklas Hasse <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

std::shared_ptr serialization asymmetry (depends on memory layout)

3 participants