Security: Early resizing before pointer is properly allocated in fss_write pipe handling.

The array address is being capture prior to the resize that ensures the memory exists.
This can result in invalid memory access.

diff --git a/level_3/fss_write/c/main/fss_write.c b/level_3/fss_write/c/main/fss_write.c
index f3b3e48..8aa9795 100644 (file)
--- a/level_3/fss_write/c/main/fss_write.c
+++ b/level_3/fss_write/c/main/fss_write.c
@@ -124,15 +124,11 @@ extern "C" {
     const f_number_unsigned_t used_contentss = main->setting.contentss.used;
     const f_number_unsigned_t used_ignoress = main->setting.ignoress.used;
 
-    main->setting.object = &main->setting.objects.array[used_objects];
-    main->setting.contents = &main->setting.contentss.array[used_contentss];
-    main->setting.ignores = &main->setting.ignoress.array[used_ignoress];
-
     // 0x0 = nothing printed, 0x1 = something printed, 0x2 = ignore enabled, 0x4 = added Content for Object.
-    uint8_t flag = 0;
+    uint8_t flag = 0x0;
 
     // 0x0 = start new object/content set, 0x1 = processing object, 0x2 = processing content, 0x3 = end object/content set.
-    uint8_t state = 0;
+    uint8_t state = 0x0;
 
     // This is processed in a single set, so there is only ever one Object added.
     main->setting.state.status = f_memory_array_increase(main->setting.state.step_small, sizeof(f_string_dynamic_t), (void **) &main->setting.objects.array, &main->setting.objects.used, &main->setting.objects.size);
@@ -143,6 +139,8 @@ extern "C" {
       return;
     }
 
+    main->setting.object = &main->setting.objects.array[used_objects];
+
     // This is processed in a single set, so there is only ever one Content added.
     main->setting.state.status = f_memory_array_increase(main->setting.state.step_small, sizeof(f_string_dynamics_t), (void **) &main->setting.contentss.array, &main->setting.contentss.used, &main->setting.contentss.size);
 
@@ -152,6 +150,8 @@ extern "C" {
       return;
     }
 
+    main->setting.contents = &main->setting.contentss.array[used_contentss];
+
     main->setting.state.status = f_memory_array_increase(main->setting.state.step_small, sizeof(f_string_dynamic_t), (void **) &main->setting.contents->array, &main->setting.contents->used, &main->setting.contents->size);
 
     if (F_status_is_error(main->setting.state.status)) {
@@ -169,6 +169,8 @@ extern "C" {
       return;
     }
 
+    main->setting.ignores = &main->setting.ignoress.array[used_ignoress];
+
     f_status_t status_pipe = F_okay;
 
     f_file_t input = f_file_t_initialize;