Autres/audacity
1
0
Fork 0
mirror of https://github.com/cookiengineer/audacity synced 2025-11-01 06:33:53 +01:00
Code Issues Releases Wiki Activity

Fix for unsafe char* to wchar_t* cast (CWE-704)

Browse Source 
* Add `void*` cast to indicate we are sure that the byte string is valid.
* Make `ProjectSerializer.cpp` use `static_cast` to preserve pointer addresses.
* Replace incorrect usage of `int` where `size_t` was appropriate

Signed-off-by: Emily Mabrey <emabrey@tenacityaudio.org>
Reference-to: https://github.com/tenacityteam/tenacity/pull/417
This commit is contained in:
Emily Mabrey
2021-07-31 01:42:55 -04:00
committed by GitHub
parent 3e4a2cf316
commit 657a83b9ef
1 changed files with 19 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
src/ProjectSerializer.cpp
View File

@@ -407,35 +407,34 @@ wxString ProjectSerializer::Decode(const wxMemoryBuffer &buffer)
return iter->second;
};
auto ReadString = [&mCharSize, &in, &bytes](int len) -> wxString
auto ReadString = [&mCharSize, &in, &bytes](size_t len) -> wxString
{
bytes.reserve( len + 4 );
auto data = bytes.data();
in.Read( data, len );
// Make a null terminator of the widest type
memset( data + len, '\0', 4 );
wxUString str;
switch (mCharSize)
{
case 1:
str.assignFromUTF8(data, len);
break;
case 2:
str.assignFromUTF16((wxChar16 *) data, len / 2);
break;
switch (mCharSize) {
case 1:
wxASSERT(sizeof(decltype(*data)) == sizeof(char));
// The void* silences the CodeQL CWE-704 detection
return wxUString().assignFromUTF8(static_cast<char*>(static_cast<void*>(data)), len);
case 4:
str = wxU32CharBuffer::CreateNonOwned((wxChar32 *) data, len / 4);
break;
case 2:
wxASSERT(sizeof(wxChar16) == 2 * sizeof(char));
// The void* silences the CodeQL CWE-704 detection
return wxUString().assignFromUTF16(static_cast<wxChar16*>(static_cast<void*>(data)), len / 2);
default:
wxASSERT_MSG(false, wxT("Characters size not 1, 2, or 4"));
break;
case 4:
wxASSERT(sizeof(wxChar32) == 4 * sizeof(char));
// The void* silences the CodeQL CWE-704 detection
return wxUString().assign(static_cast<wxChar32*>(static_cast<void*>(data)), len / 4);
default:
wxASSERT_MSG(false, wxT("Characters size not 1, 2, or 4"));
return wxUString();
}
return str;
};
try
@@ -588,7 +587,7 @@ wxString ProjectSerializer::Decode(const wxMemoryBuffer &buffer)
}
}
}
catch( const Error& )
catch( const Error& e)
{
// Document was corrupt, or platform differences in size or endianness
// were not well canonicalized