T09 · Insecure Skill Coding Practices
Warning
- Location
code.c:186- Finding
Undefined Behavior When Parsing an Empty Configuration Value
- Content
View full analysis
value && (*end == '\n' || *end == '\r' || *end == ' ')) *end-- = '\0'; ``` ### Technical Analysis When a configuration entry has an empty value and no trailing newline, such as `key=` at the end of a file, `value` points to an empty string and `strlen(value)` returns zero. The expression below consequently attempts to form a pointer one byte before the beginning of the `value` object: ```c char* end = value + strlen(value) - 1; ``` Forming this out-of-bounds pointer is undefined behavior under the C memory model, even if the following loop condition normally prevents it from being dereferenced. Compiler optimizations, runtime instrumentation, or platform-specific behavior may therefore produce unpredictable results. The same condition can occur after leading spaces or tabs are skipped if no other characters remain and the line has no newline terminator. ### Attack Path 1. An attacker gains control over a configuration file accepted by an application using this library. 2. The attacker places an empty assignment such as `key=` as the final line without a newline. 3. The application calls `config_load_file()` on that file. 4. The parser calculates `value + 0 - 1`, forming an invalid pointer. 5. The application encounters undefined, compiler-dependent behavior and may terminate, particularly under memory-safety instrumentation or hardened runtime environments. ### Impact Assessment The direct impact is availability loss or unpredictable configuration parsing in the process loading the malicious file. The flaw ...[truncated 275 chars]- Remediation
View remediation
0) { char last = value[value_len - 1]; if (last != '\n' && last != '\r' && last != ' ' && last != '\t') { break; } value[--value_len] = '\0'; } ``` Additionally: - Define and test the intended behavior for empty configuration values. - Add regression tests for `key=`, `key= `, empty final lines, and files both with and without trailing newlines. - Compile tests with AddressSanitizer and UndefinedBehaviorSanitizer. ]]>