refactor: Avoid UB in SpanReader::ignore
What the developer wrote
Authored by MarcoFalke
refactor: Avoid UB in SpanReader::ignore
Currently std::span::subspan is called without checking the size first.
This is UB, unless the std lib is hardened.
With a hardened stdlib, the program aborts:
> include/c++/v1/span:512: libc++ Hardening assertion __offset <= size()
> failed: span<T>::subspan(offset, count): offset out of range
Fix the UB and the abort by using the implementation from DataStream,
which throws when hitting end-of-data.
This commit should not change any behavior, because the UB is currently
unreachable. Also, the newly added throw should properly be caught by
any code that calls any streams function.
What changed, and why it matters
This is a small defensive code cleanup in Bitcoin Core. A function called SpanReader::ignore could previously call a standard-library span operation with an oversized offset, which is undefined behavior and, with hardening enabled, causes the program to crash. The fix adds a bounds check that throws a normal end-of-data exception instead. The commit message says this bad path was not reachable in practice, so the change is mainly about removing undefined behavior rather than fixing an exploitable bug.
Treat as a low-risk hardening/refactor commit. Review whether any callers of SpanReader::ignore rely on non-throwing behavior, and consider adding a regression test for the oversized-ignore path. No urgent security response is indicated by the commit itself.
Security signals we found
Undefined behavior in span bounds operation
Hardened standard-library abort path removed
Exception-based end-of-data handling added
Author states the bad path is currently unreachable
Evidence from the diff
SpanReader::ignore(size_t n) in src/streams.h previously invoked std::span::subspan(n) without verifying that n was within m_data.size(). That is undefined behavior per the C++ standard; with a hardened standard library (e.g., libc++ hardening) it aborts with an assertion failure. The patch adds an explicit size check and throws std::ios_base::failure(“SpanReader::ignore(): end of data”) when n exceeds the remaining span, mirroring DataStream behavior. The commit author states the UB was unreachable and that callers already handle stream exceptions.
Changed components
src/streams.hSpanReader::ignoreInspect captured patch +3 / −0
diff --git a/src/streams.h b/src/streams.h
index e5a18c56..be6b7452 100644
--- a/src/streams.h
+++ b/src/streams.h
@@ -117,6 +117,9 @@ public:
void ignore(size_t n)
{
+ if (n > m_data.size()) {
+ throw std::ios_base::failure("SpanReader::ignore(): end of data");
+ }
m_data = m_data.subspan(n);
}
};
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.