Skip to content

fix: antlr3_calloc(1, sizeof(anmllexer)) at line 474... in ANMLLexer.cpp#195

Open
orbisai0security wants to merge 1 commit into
nasa:masterfrom
orbisai0security:fix-fix-v005-null-check-antlr-parser-alloc
Open

fix: antlr3_calloc(1, sizeof(anmllexer)) at line 474... in ANMLLexer.cpp#195
orbisai0security wants to merge 1 commit into
nasa:masterfrom
orbisai0security:fix-fix-v005-null-check-antlr-parser-alloc

Conversation

@orbisai0security

Copy link
Copy Markdown

Summary

Fix high severity security issue in src/PLASMA/ANML/base/ANMLLexer.cpp.

Vulnerability

Field Value
ID V-005
Severity HIGH
Scanner multi_agent_ai
Rule V-005
File src/PLASMA/ANML/base/ANMLLexer.cpp:474

Description: ANTLR3_CALLOC(1, sizeof(ANMLLexer)) at line 474 and ANTLR3_CALLOC(1, sizeof(ANMLParser)) at line 509 allocate memory for the lexer and parser contexts. If these allocations fail under memory pressure (returning NULL) and the returned pointer is not checked before use, subsequent dereferences of ctx will cause a NULL pointer dereference, crashing the process. An attacker who can trigger repeated large ANML parse requests can exhaust memory and force allocation failures.

Changes

  • src/PLASMA/ANML/base/ANMLParser.cpp

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

Automated security fix generated by Orbis Security AI
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant