Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 6 additions & 12 deletions src/backends/native/sentry_crash_ipc.c
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,10 @@
sentry_crash_ipc_t *
sentry__crash_ipc_init_app(sem_t *init_sem)
{
sentry_crash_ipc_t *ipc = SENTRY_MAKE(sentry_crash_ipc_t);
sentry_crash_ipc_t *ipc = SENTRY_MAKE_0(sentry_crash_ipc_t);
if (!ipc) {
return NULL;
}
memset(ipc, 0, sizeof(sentry_crash_ipc_t));
ipc->is_daemon = false;
ipc->init_sem = init_sem; // Use provided semaphore (managed by backend)

Expand Down Expand Up @@ -175,11 +174,10 @@ sentry_crash_ipc_t *
sentry__crash_ipc_init_daemon(
pid_t app_pid, uint64_t app_tid, int notify_eventfd, int ready_eventfd)
{
sentry_crash_ipc_t *ipc = SENTRY_MAKE(sentry_crash_ipc_t);
sentry_crash_ipc_t *ipc = SENTRY_MAKE_0(sentry_crash_ipc_t);
if (!ipc) {
return NULL;
}
memset(ipc, 0, sizeof(sentry_crash_ipc_t));
ipc->is_daemon = true;

// Open existing shared memory created by app (using PID and thread ID)
Expand Down Expand Up @@ -312,11 +310,10 @@ sentry__crash_ipc_free(sentry_crash_ipc_t *ipc)
sentry_crash_ipc_t *
sentry__crash_ipc_init_app(sem_t *init_sem)
{
sentry_crash_ipc_t *ipc = SENTRY_MAKE(sentry_crash_ipc_t);
sentry_crash_ipc_t *ipc = SENTRY_MAKE_0(sentry_crash_ipc_t);
if (!ipc) {
return NULL;
}
memset(ipc, 0, sizeof(sentry_crash_ipc_t));
ipc->is_daemon = false;
ipc->init_sem = init_sem; // Use provided semaphore (managed by backend)

Expand Down Expand Up @@ -470,11 +467,10 @@ sentry_crash_ipc_t *
sentry__crash_ipc_init_daemon(
pid_t app_pid, uint64_t app_tid, int notify_pipe_read, int ready_pipe_write)
{
sentry_crash_ipc_t *ipc = SENTRY_MAKE(sentry_crash_ipc_t);
sentry_crash_ipc_t *ipc = SENTRY_MAKE_0(sentry_crash_ipc_t);
if (!ipc) {
return NULL;
}
memset(ipc, 0, sizeof(sentry_crash_ipc_t));
ipc->is_daemon = true;

// Open existing shared memory created by app (using PID and thread ID)
Expand Down Expand Up @@ -604,11 +600,10 @@ sentry__crash_ipc_free(sentry_crash_ipc_t *ipc)
sentry_crash_ipc_t *
sentry__crash_ipc_init_app(HANDLE init_mutex)
{
sentry_crash_ipc_t *ipc = SENTRY_MAKE(sentry_crash_ipc_t);
sentry_crash_ipc_t *ipc = SENTRY_MAKE_0(sentry_crash_ipc_t);
if (!ipc) {
return NULL;
}
memset(ipc, 0, sizeof(sentry_crash_ipc_t));
ipc->is_daemon = false;
ipc->init_mutex = init_mutex; // Use provided mutex (managed by backend)

Expand Down Expand Up @@ -734,11 +729,10 @@ sentry__crash_ipc_init_daemon(pid_t app_pid, uint64_t app_tid,
(void)event_handle;
(void)ready_event_handle;

sentry_crash_ipc_t *ipc = SENTRY_MAKE(sentry_crash_ipc_t);
sentry_crash_ipc_t *ipc = SENTRY_MAKE_0(sentry_crash_ipc_t);
if (!ipc) {
return NULL;
}
memset(ipc, 0, sizeof(sentry_crash_ipc_t));
ipc->is_daemon = true;

// Open existing shared memory (using PID and thread ID)
Expand Down
3 changes: 1 addition & 2 deletions src/backends/sentry_backend_breakpad.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -331,11 +331,10 @@ sentry__backend_preload(void)
sentry_backend_t *
sentry__backend_new(void)
{
auto *backend = SENTRY_MAKE(sentry_backend_t);
auto *backend = SENTRY_MAKE_0(sentry_backend_t);
if (!backend) {
return nullptr;
}
memset(backend, 0, sizeof(sentry_backend_t));

backend->startup_func = breakpad_backend_startup;
backend->shutdown_func = breakpad_backend_shutdown;
Expand Down
3 changes: 1 addition & 2 deletions src/backends/sentry_backend_crashpad.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1037,11 +1037,10 @@ sentry__backend_preload(void)
sentry_backend_t *
sentry__backend_new(void)
{
auto *backend = SENTRY_MAKE(sentry_backend_t);
auto *backend = SENTRY_MAKE_0(sentry_backend_t);
if (!backend) {
return nullptr;
}
memset(backend, 0, sizeof(sentry_backend_t));

auto *data = new (std::nothrow) crashpad_state_t {};
if (!data) {
Expand Down
3 changes: 1 addition & 2 deletions src/backends/sentry_backend_inproc.c
Original file line number Diff line number Diff line change
Expand Up @@ -1810,11 +1810,10 @@ sentry__backend_preload(void)
sentry_backend_t *
sentry__backend_new(void)
{
sentry_backend_t *backend = SENTRY_MAKE(sentry_backend_t);
sentry_backend_t *backend = SENTRY_MAKE_0(sentry_backend_t);
if (!backend) {
return NULL;
}
memset(backend, 0, sizeof(sentry_backend_t));

backend->startup_func = startup_inproc_backend;
backend->shutdown_func = shutdown_inproc_backend;
Expand Down
7 changes: 2 additions & 5 deletions src/backends/sentry_backend_native.c
Original file line number Diff line number Diff line change
Expand Up @@ -117,11 +117,10 @@ native_backend_startup(
sentry__mutex_unlock(&g_ipc_init_mutex);
#endif

native_backend_state_t *state = SENTRY_MAKE(native_backend_state_t);
native_backend_state_t *state = SENTRY_MAKE_0(native_backend_state_t);
if (!state) {
return 1;
}
memset(state, 0, sizeof(native_backend_state_t));
backend->data = state;

// Initialize IPC (protected by global synchronization for concurrent
Expand Down Expand Up @@ -930,13 +929,11 @@ sentry__backend_preload(void)
sentry_backend_t *
sentry__backend_new(void)
{
sentry_backend_t *backend = SENTRY_MAKE(sentry_backend_t);
sentry_backend_t *backend = SENTRY_MAKE_0(sentry_backend_t);
if (!backend) {
return NULL;
}

memset(backend, 0, sizeof(sentry_backend_t));

backend->startup_func = native_backend_startup;
backend->shutdown_func = native_backend_shutdown;
backend->free_func = native_backend_free;
Expand Down
14 changes: 14 additions & 0 deletions src/sentry_alloc.c
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,20 @@ sentry_malloc(size_t size)
return malloc(size);
}

void *
sentry__calloc(size_t count, size_t size)
{
#ifdef WITH_PAGE_ALLOCATOR
if (sentry__page_allocator_enabled()) {
// the page allocator is a bump allocator backed by mmap(MAP_ANONYMOUS),
// which the OS guarantees to be zeroed on first use, and the page
// allocator never reuses freed allocations
return sentry__page_allocator_alloc(count * size);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing overflow check in calloc replacement

Low Severity

sentry__calloc performs count * size without an overflow check in the page allocator path. Standard calloc is required to detect when count * size overflows and return NULL. Here, a wrapping multiplication could cause sentry__page_allocator_alloc to allocate a much smaller buffer than expected, leading to a buffer overflow when the caller writes to it. Currently safe because SENTRY_MAKE_0 always passes count=1, but the function's calloc-like interface invites future callers that may not have this guarantee.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit caffdc0. Configure here.

}
#endif
return calloc(count, size);
}

void
sentry_free(void *ptr)
{
Expand Down
6 changes: 6 additions & 0 deletions src/sentry_alloc.h
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,10 @@
*/
#define SENTRY_MAKE(Type) (Type *)sentry_malloc(sizeof(Type))

/**
* This is a typed `calloc` that zero-initializes the allocation.
*/
void *sentry__calloc(size_t count, size_t size);
#define SENTRY_MAKE_0(Type) (Type *)sentry__calloc(1, sizeof(Type))

#endif
9 changes: 3 additions & 6 deletions src/sentry_attachment.c
Original file line number Diff line number Diff line change
Expand Up @@ -74,12 +74,11 @@ sentry__attachment_from_path(sentry_path_t *path)
if (!path) {
return NULL;
}
sentry_attachment_t *attachment = SENTRY_MAKE(sentry_attachment_t);
sentry_attachment_t *attachment = SENTRY_MAKE_0(sentry_attachment_t);
if (!attachment) {
sentry__path_free(path);
return NULL;
}
memset(attachment, 0, sizeof(sentry_attachment_t));
attachment->path = path;
return attachment;
}
Expand All @@ -95,12 +94,11 @@ sentry__attachment_from_buffer(
sentry__path_free(filename);
return NULL;
}
sentry_attachment_t *attachment = SENTRY_MAKE(sentry_attachment_t);
sentry_attachment_t *attachment = SENTRY_MAKE_0(sentry_attachment_t);
if (!attachment) {
sentry__path_free(filename);
return NULL;
}
memset(attachment, 0, sizeof(sentry_attachment_t));
attachment->filename = filename;
attachment->buf = sentry_malloc(buf_len * sizeof(char));
memcpy(attachment->buf, buf, buf_len * sizeof(char));
Expand Down Expand Up @@ -216,11 +214,10 @@ attachment_clone(const sentry_attachment_t *attachment)
return NULL;
}

sentry_attachment_t *clone = SENTRY_MAKE(sentry_attachment_t);
sentry_attachment_t *clone = SENTRY_MAKE_0(sentry_attachment_t);
if (!clone) {
return NULL;
}
memset(clone, 0, sizeof(sentry_attachment_t));

if (attachment->path) {
clone->path = sentry__path_clone(attachment->path);
Expand Down
4 changes: 1 addition & 3 deletions src/sentry_batcher.c
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
#include "sentry_cpu_relax.h"
#include "sentry_options.h"
#include "sentry_utils.h"
#include <string.h>

// The batcher thread sleeps for this interval between flush cycles.
// When the timer fires and there are items in the buffer, they are flushed
Expand All @@ -24,11 +23,10 @@ sentry_batcher_t *
sentry__batcher_new(
sentry_batch_func_t batch_func, sentry_data_category_t data_category)
{
sentry_batcher_t *batcher = SENTRY_MAKE(sentry_batcher_t);
sentry_batcher_t *batcher = SENTRY_MAKE_0(sentry_batcher_t);
if (!batcher) {
return NULL;
}
memset(batcher, 0, sizeof(sentry_batcher_t));
batcher->refcount = 1;
batcher->batch_func = batch_func;
batcher->data_category = data_category;
Expand Down
3 changes: 1 addition & 2 deletions src/sentry_hint.c
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,10 @@
sentry_hint_t *
sentry_hint_new(void)
{
sentry_hint_t *hint = SENTRY_MAKE(sentry_hint_t);
sentry_hint_t *hint = SENTRY_MAKE_0(sentry_hint_t);
if (!hint) {
return NULL;
}
memset(hint, 0, sizeof(sentry_hint_t));
return hint;
}

Expand Down
3 changes: 1 addition & 2 deletions src/sentry_options.c
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,10 @@
sentry_options_t *
sentry_options_new(void)
{
sentry_options_t *opts = SENTRY_MAKE(sentry_options_t);
sentry_options_t *opts = SENTRY_MAKE_0(sentry_options_t);
if (!opts) {
return NULL;
}
memset(opts, 0, sizeof(sentry_options_t));
opts->database_path = sentry__path_from_str(".sentry-native");
// we assume the DSN to be ASCII only
sentry_options_set_dsn(opts, getenv("SENTRY_DSN"));
Expand Down
3 changes: 1 addition & 2 deletions src/sentry_retry.c
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,10 @@ struct sentry_retry_s {
sentry_retry_t *
sentry__retry_new(const sentry_options_t *options)
{
sentry_retry_t *retry = SENTRY_MAKE(sentry_retry_t);
sentry_retry_t *retry = SENTRY_MAKE_0(sentry_retry_t);
if (!retry) {
return NULL;
}
memset(retry, 0, sizeof(sentry_retry_t));
sentry__mutex_init(&retry->sealed_lock);
retry->run = sentry__run_incref(options->run);
retry->cache_keep = options->cache_keep;
Expand Down
4 changes: 2 additions & 2 deletions src/sentry_scope.c
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,6 @@ get_client_sdk(void)
static void
init_scope(sentry_scope_t *scope)
{
memset(scope, 0, sizeof(sentry_scope_t));
scope->release = NULL;
scope->environment = NULL;
scope->transaction = NULL;
Expand Down Expand Up @@ -96,6 +95,7 @@ get_scope(void)
return &g_scope;
}

memset(&g_scope, 0, sizeof(sentry_scope_t));
init_scope(&g_scope);
sentry_value_set_by_key(g_scope.contexts, "os", sentry__get_os_context());
g_scope.client_sdk = get_client_sdk();
Expand Down Expand Up @@ -169,7 +169,7 @@ sentry__scope_flush_unlock(void)
sentry_scope_t *
sentry_local_scope_new(void)
{
sentry_scope_t *scope = SENTRY_MAKE(sentry_scope_t);
sentry_scope_t *scope = SENTRY_MAKE_0(sentry_scope_t);
if (!scope) {
return NULL;
}
Expand Down
7 changes: 2 additions & 5 deletions src/sentry_sync.c
Original file line number Diff line number Diff line change
Expand Up @@ -176,14 +176,13 @@ struct sentry_bgworker_s {
sentry_bgworker_t *
sentry__bgworker_new(void *state, void (*free_state)(void *state))
{
sentry_bgworker_t *bgw = SENTRY_MAKE(sentry_bgworker_t);
sentry_bgworker_t *bgw = SENTRY_MAKE_0(sentry_bgworker_t);
if (!bgw) {
if (free_state) {
free_state(state);
}
return NULL;
}
memset(bgw, 0, sizeof(sentry_bgworker_t));
sentry__thread_init(&bgw->thread_id);
sentry__mutex_init(&bgw->task_lock);
sentry__cond_init(&bgw->submit_signal);
Expand Down Expand Up @@ -369,12 +368,10 @@ sentry__bgworker_flush(sentry_bgworker_t *bgw, uint64_t timeout)
}
SENTRY_DEBUG("flushing background worker thread");

sentry_flush_task_t *flush_task
= sentry_malloc(sizeof(sentry_flush_task_t));
sentry_flush_task_t *flush_task = SENTRY_MAKE_0(sentry_flush_task_t);
if (!flush_task) {
return 1;
}
memset(flush_task, 0, sizeof(sentry_flush_task_t));
flush_task->refcount = 2; // this thread + background worker
flush_task->was_flushed = false;
sentry__cond_init(&flush_task->signal);
Expand Down
3 changes: 1 addition & 2 deletions src/sentry_transport.c
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,10 @@ sentry_transport_t *
sentry_transport_new(
void (*send_func)(sentry_envelope_t *envelope, void *state))
{
sentry_transport_t *transport = SENTRY_MAKE(sentry_transport_t);
sentry_transport_t *transport = SENTRY_MAKE_0(sentry_transport_t);
if (!transport) {
return NULL;
}
memset(transport, 0, sizeof(sentry_transport_t));
transport->send_envelope_func = send_func;

return transport;
Expand Down
3 changes: 1 addition & 2 deletions src/sentry_utils.c
Original file line number Diff line number Diff line change
Expand Up @@ -234,11 +234,10 @@ sentry__dsn_new_n(const char *raw_dsn, size_t raw_dsn_len)
// org_id is u64 in relay, so needs 20 characters + null termination
char org_id[21] = "";

sentry_dsn_t *dsn = SENTRY_MAKE(sentry_dsn_t);
sentry_dsn_t *dsn = SENTRY_MAKE_0(sentry_dsn_t);
if (!dsn) {
return NULL;
}
memset(dsn, 0, sizeof(sentry_dsn_t));
dsn->refcount = 1;

dsn->raw = sentry__string_clone_n(raw_dsn, raw_dsn_len);
Expand Down
Loading
Loading