Skip to content

fix(rpc4): NUL-terminate RPC4GlobalRegistration functionName - #52

Merged
Segfaultd merged 2 commits into
masterfrom
fix/rpc4-global-registration-nul-termination
Aug 19, 2026
Merged

fix(rpc4): NUL-terminate RPC4GlobalRegistration functionName#52
Segfaultd merged 2 commits into
masterfrom
fix/rpc4-global-registration-nul-termination

Conversation

@Segfaultd

Copy link
Copy Markdown
Member

Fixes #6.

Problem

All four RPC4GlobalRegistration constructors copied uniqueID into the fixed GlobalRegistration::functionName[48] buffer without writing a terminating NUL. A uniqueID of exactly RPC4_GLOBAL_REGISTRATION_MAX_FUNCTION_NAME_LENGTH characters filled the buffer completely, and RPC4::OnAttach() later handed it to RegisterFunction / RegisterSlot / RegisterBlockingFunction, where RakString::Assign calls strlen — reading past the array.

Fix

Slightly stronger than the fix sketched in the issue (which would still have written the terminator one past the end for a name longer than the buffer):

  • The copy loop is clamped to RPC4_GLOBAL_REGISTRATION_MAX_FUNCTION_NAME_LENGTH - 1 characters, so even an over-long name cannot overflow the array in release builds where RakAssert compiles out.
  • The terminator is always written after the loop.
  • RakAssert(uniqueID[i]==0) still flags any truncation in debug builds.

Applied identically to all four constructors.

Tests

New Tests/Unit/RPC4GlobalRegistrationTests.cpp:

  • MaxLengthNameIsStoredNulTerminated — a 47-char name round-trips through global registration → OnAttachUnregisterFunction.
  • OverlongNameIsTruncatedNotOverflowed — a 53-char name is clamped to 47 chars + NUL instead of overflowing (release-only; skipped in debug where the assert fires).

Full unit suite (121 tests) and the RPC4 integration test pass on a Release build.

The copy loops in all four RPC4GlobalRegistration constructors never wrote
a terminating NUL, so a uniqueID of exactly
RPC4_GLOBAL_REGISTRATION_MAX_FUNCTION_NAME_LENGTH bytes filled the buffer
and the later strlen in RakString::Assign (via RPC4::OnAttach ->
RegisterFunction/RegisterSlot/RegisterBlockingFunction) read past the array.

Clamp the copy to what fits (rather than only asserting, which is a no-op
in release and would still let an over-long name overflow the array) and
always write the terminator. RakAssert still flags truncation in debug.

Fixes #6
@coderabbitai

coderabbitai Bot commented Aug 19, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@Segfaultd, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 72d32987-bc33-44a3-b7fa-8401430c3ec4

📥 Commits

Reviewing files that changed from the base of the PR and between 0f6179b and e38f3c0.

📒 Files selected for processing (3)
  • Source/src/RPC4Plugin.cpp
  • Tests/CMakeLists.txt
  • Tests/Unit/RPC4GlobalRegistrationTests.cpp

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

The truncation-backstop test guards itself with #ifdef _DEBUG to skip when
RakAssert is live, but _DEBUG was a PRIVATE compile definition on the
library target only — the test TU never saw it, so in Debug builds the
test ran anyway and tripped the assert. Mirror the library's Debug
definition onto the UnitTests target so the guard matches the library's
actual assert configuration.
@Segfaultd
Segfaultd merged commit 5817395 into master Aug 19, 2026
6 checks passed
@Segfaultd
Segfaultd deleted the fix/rpc4-global-registration-nul-termination branch August 19, 2026 20:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RPC4GlobalRegistration: functionName not NUL-terminated for max-length uniqueID

1 participant