tree 57c9ae6237c32f4e0077a2dd728f4a2a0ac662ba
parent bab10754d93d74d1ff44d46de63558bc4127f7d8
author Rifat Al Jubayer <45924460+kakarotsec@users.noreply.github.com> 1777947090 +0600
committer GitHub <noreply@github.com> 1777947090 -0400
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJp+VHSCRC1aQ7uu5UhlAAAF2sQABOfFQKuhxUDW+H9/kuQBKK8
 Pf+jLlefzEkZsdO/2M9bHvc2x5QyHEkLYHf0Ts2YI8cdo0SQEEXPme5C4lpKum8k
 wBYv2zsqnxjjtynK3iYZkzf+AFfYwXJAjt2GOCNRhpshNIO5vOPrQn1+zyt5GmiG
 uKGZzO8Z8zPcuywhq4GNvmtw6WM32q/+emLkaMXT3rieTAjwdfAROQEryWZ826Cr
 J9t22nrBMMb9YZQXhw0zEAxbG56TeDISI2Z+JnHzoABNQlpblLHs+xVo7t7LgqXn
 tXW/AcitObtDNkKf0R2z5WlRpS26HdcppcZFGse+RGEg/lbJDD6t74rExxaBoTbJ
 Ye5iafmajZhHFC02vXOT2plgB8hrZzKCICOzXCJ68bwjC/O71i7W9q1w7vk2XXMw
 TR+RFvAVLrnij7l9tCroUeGYxmGubZzC9DXzBD/ILtiITF/RCwzJLMXRGLPxzInU
 rgWZsC52qSUEjn0iLhEnIf2P9Tozb8Fc6CCwGY1Is4nqTe23fkcjaxMMK0ngJpgP
 kLVZ1Htv1mpELsva3Gir9bSHzwVyfidhBk8d/H9eYYyz/EFaIRG+NGZss+x12hUa
 KOajwj9KtAzXTv87GBJ3SCu6Pi2plxkX5P3zXXHpBw0c75nBRK7Mpq2n5AsMwoj0
 OBMhplogpecm6hYfci/c
 =VEQ3
 -----END PGP SIGNATURE-----
 

Fix logic inversion in FlexBuffers VerifyKey() (#9072)

VerifyKey() returns true on the first non-zero byte instead of
checking for a null terminator. This causes VerifyBuffer() to accept
FlexBuffers with non-null-terminated keys. Subsequent access to those
keys via strlen()/strcmp() reads out of bounds.

The condition if (*p++) should be if (!*p++) — return true
when a null terminator is found, not when any non-zero byte is found.

Confirmed with AddressSanitizer: heap-buffer-overflow in strlen()
after VerifyBuffer() returns true on a corrupted buffer.