1

Supposing a remote service has the following data structures (using C++ as an example):

struct Item
{
    std::string name;
    struct {} whatever_else;
};

std::map <std::string, Item *> all_items;

and we use the Item* to identify stored items, converting it to an integer type

std::set <size_t> all_item_ids;

size_t id (Item * i)
{
    return reinterpret_cast <size_t> (i);
}

void insert (Item * i)
{
    all_item_ids.insert (id (i));

    all_items[i->name] = i;
}

and suppose it exposes this API to a remote client

size_t find (std::string name)
{
    auto i = all_items.find (name);

    return (all_items.end () = i) ? 0 : id (i->second);
}

void do_something (size_t id)
{
    if (contains (all_item_ids, id))
        do_something (reinterpret_cast <Item *> (id));
}

To my eye, this should not present a security hazard because, even assuming a malicious client, the do_something API verifies that any given input is convertible to a valid Item* before proceeding.

The greatest theoretical danger I can think of is that it's giving statistical information to an attacker about how the OS is allocating memory, so there could be in-principle a way to e.g. tell if many or few Item objects are being allocated, or how these allocations are clustered, or something like that. This is not a threat in my security model.

Let's also assume that the all_item_ids index always corresponds exactly to the items in all_items, so there are no false positives or false negatives in if (contains (all_item_ids, id)).

Am I missing something, or is okay to expose pointers in an API in this manner?

  • 1
    Not a full answer right now, but leaking pointers is considered an information disclosure vulnerability. – forest Jan 8 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.