Source code
Revision control
Copy as Markdown
Other Tools
diff --git a/include/rlbox_stdlib.hpp b/include/rlbox_stdlib.hpp
--- a/include/rlbox_stdlib.hpp
+++ b/include/rlbox_stdlib.hpp
@@ -173,11 +173,13 @@ inline T_Wrap<T_Rhs*, T_Sbx> memcpy(rlbo
void* dest_start = dest_tainted.INTERNAL_unverified_safe();
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(dest_start, num_val);
- // src also needs to be checked, as we don't want to allow a src rand to start
- // inside the sandbox and end outside, and vice versa
// src may or may not be a wrapper, so use unwrap_value
const void* src_start = detail::unwrap_value(src);
- detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src_start, num_val);
+
+ // if src is also a tainted/tainted-volatile pointer apply the same check
+ if constexpr(detail::rlbox_is_tainted_or_vol_v<T_Lhs>) {
+ detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src_start, num_val);
+ }
std::memcpy(dest_start, src_start, num_val);
@@ -205,11 +207,13 @@ inline tainted_int_hint memcmp(rlbox_san
void* dest_start = dest.INTERNAL_unverified_safe();
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(dest_start, num_val);
- // src also needs to be checked, as we don't want to allow a src rand to start
- // inside the sandbox and end outside, and vice versa
// src may or may not be a wrapper, so use unwrap_value
const void* src_start = detail::unwrap_value(src);
- detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src_start, num_val);
+
+ // if src is also a tainted/tainted-volatile pointer apply the same check
+ if constexpr(detail::rlbox_is_tainted_or_vol_v<T_Lhs>) {
+ detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src_start, num_val);
+ }
int ret = std::memcmp(dest_start, src_start, num_val);
tainted_int_hint converted_ret(ret);
@@ -243,6 +247,10 @@ tainted<T*, T_Sbx> copy_memory_or_grant_
"copy_memory_or_grant_access not supported on this type as "
"there may be ABI differences");
+ static_assert(!detail::rlbox_is_tainted_or_vol_v<T>,
+ "copy_memory_or_grant_access called on tainted type. Tainted "
+ "data is already accessible to the sandbox. ");
+
// overflow ok
size_t source_size = num * sizeof(T);