From ce3b1c4780df195134d91442708d2f118e554556 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 19 Feb 2022 23:17:33 +0900 Subject: [PATCH] SECURITY.md: added memory allocation error as a non security issue. mruby expects `malloc(3)` returns `NULL` for too big allocations, so even if big object allocation (e.g. `[1,2,3]*268888888888888818`) caused ASAN/Valgrind warnings, it's intentional, and we won't consider the warning as a security issue. --- SECURITY.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 2f0ae5b28..5227f98e7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -15,4 +15,6 @@ We *don't* consider following issues as vulnerabilities: * Runtime C undefined behavior (including integer overflow) * Crash caused by misused API -* Crash caused by tweaked compiled binary +* Crash caused by modified compiled binary +* ASAN/Valgrind warning for too big memory allocation + mruby assumes `malloc(3)` returns `NULL` for too big allocations