Fix ASAN heap-buffer-overflow issue on GetNaturalSize() 84/276284/1
authorJaehyun Cho <jae_hyun.cho@samsung.com>
Tue, 14 Jun 2022 04:15:12 +0000 (13:15 +0900)
committerJaehyun Cho <jae_hyun.cho@samsung.com>
Tue, 14 Jun 2022 04:30:36 +0000 (13:30 +0900)
CSharp_Dali_Actor_GetSuggestedMinimumWidth/Height calls
GetNaturalSize().
This causes ASAN heap-buffer-overflow issue when
SwigDirector_ViewWrapperImpl::GetNaturalSize() is called.

In SwigDirector_ViewWrapperImpl::GetNaturalSize(), type casting from
Dali::Vector2 to Dali::Vector3 is done so it causes ASAN
heap-buffer-overflow issue.

Not to cause ASAN heap-buffer-overflow issue, casting Dali::Vector2 and
assigning it to Dali::Vector3 is required.

Change-Id: I1a85da7440c517f5cd27c32b535359d670b57655

dali-csharp-binder/src/view-wrapper-impl-wrap.cpp

index 61b0af2..de6935a 100755 (executable)
@@ -137,7 +137,12 @@ Dali::Vector3 SwigDirector_ViewWrapperImpl::GetNaturalSize() {
       SWIG_CSharpSetPendingExceptionArgument(SWIG_CSharpArgumentNullException, "Unexpected null return for type Dali::Vector3", 0);
       return c_result;
     }
-    c_result = *(Dali::Vector3 *)jresult;
+
+    // Tizen.NUI.ViewWrapperImpl.DirectorGetNaturalSize() is assigned to swig_callbackGetNaturalSize().
+    // Tizen.NUI.ViewWrapperImpl.DirectorGetNaturalSize() returns Dali::Vector2.
+    // Moreover, Dali::Vector3 supports operator '=' with Dali::Vector2.
+    // Not to cause ASAN heap-buffer-overflow issue here, casting Dali::Vector2 and assigning it to Dali::Vector3 is required.
+    c_result = *(Dali::Vector2 *)jresult;
   }
   return c_result;
 }