mirror of
https://github.com/zhigang1992/react-native.git
synced 2026-04-24 04:16:00 +08:00
Check return code from malloc (#20173)
Summary: Calls abort() in cases where malloc returns NULL. Checking the return value from malloc is good practice and is required to pass a [Veracode security scan](https://www.veracode.com/). This will let developers who are required to submit their software to Veracode use React Native. Pull Request resolved: https://github.com/facebook/react-native/pull/20173 Differential Revision: D9235096 Pulled By: hramos fbshipit-source-id: 9fdc97f9e84f8d4d91ae59242093907f7a81d286
This commit is contained in:
committed by
Facebook Github Bot
parent
03663491c6
commit
b21d4914de
@@ -50,6 +50,12 @@ static NSString *RCTGenerateFormBoundary()
|
||||
const char *boundaryChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.";
|
||||
|
||||
char *bytes = (char*)malloc(boundaryLength);
|
||||
if (!bytes) {
|
||||
// CWE - 391 : Unchecked error condition
|
||||
// https://www.cvedetails.com/cwe-details/391/Unchecked-Error-Condition.html
|
||||
// https://eli.thegreenplace.net/2009/10/30/handling-out-of-memory-conditions-in-c
|
||||
abort();
|
||||
}
|
||||
size_t charCount = strlen(boundaryChars);
|
||||
for (int i = 0; i < boundaryLength; i++) {
|
||||
bytes[i] = boundaryChars[arc4random_uniform((u_int32_t)charCount)];
|
||||
|
||||
Reference in New Issue
Block a user