Binary make use of malloc Function

Bug Report

Cordova iOS Applications scanned with MobSF report use of unsafe malloc function, (See also: https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/372).

Problem

See: CWE-789: Uncontrolled Memory Allocation

What is expected to happen?

Memory should be allocated via calloc.

What does actually happen?

Memory is allocated via unsafe malloc.

Information

See below.

Command or Code

Searching the repository leads me to the following line of code:

Byte* buffer = (Byte*)malloc((unsigned long)[assetRepresentation size]);

Source: https://github.com/apache/cordova-ios/blob/46da4bc34495ec7bfe13c1ec1b4074dd2e82641a/CordovaLib/Classes/Public/CDVURLProtocol.m#L65

Environment, Platform, Device

iOS

Version information

Cordova

Checklist

• I searched for existing GitHub issues
• I updated all Cordova tooling to most recent version
• I included all the necessary information above

[breautek]

there is no detriment by switching to calloc

I don’t have the experience with this code base to say exactly how significant this is, but calloc is slower. Because calloc zero-fills the allocated memory first, which you then overwrite a second time.

This is why @brodybits says it’s not necessary to use calloc over malloc because we allocate memory and immediately write to it completely.

If this API is not invoked very often then obviously the consequence of this would be negligible, but if it is a high traffic API, then the performance hit could be noticeable.

[dpogue]

CDVURLProtocol has been removed on master as part of dropping UIWebView support, so this issue no longer applies.