aegis-memory-safety

Scope & Objectives

Inventory all native code in the repository, rank it by attacker reachability, then audit each parser, copy site, allocation site, and lifetime transition for memory-safety violations. Confirm or refute every candidate finding by answering one question per sink: who controls the length, and does that length match the allocation?

• In scope (languages): C (.c/.h), C++ (.cc/.cpp/.cxx/.hpp), Objective-C / Objective-C++ (.m/.mm), Rust limited to unsafe blocks, unsafe fn, unsafe impl, FFI (extern "C") surfaces, and -sys binding crates; mixed-language boundaries between any of these.
• In scope (defect classes): buffer overflow (CWE-120/121/122); out-of-bounds read (CWE-125); index arithmetic from untrusted fields; integer truncation, signedness confusion, and size-calculation overflow (CWE-190); use-after-free (CWE-416); double free (CWE-415); dangling pointers including container-reallocation invalidation; NULL dereference reached from untrusted input (CWE-476); format-string flaws in the printf family (CWE-134); use of uninitialized or partially initialized memory (CWE-457); length-unit and ownership mistakes at FFI boundaries.
• Out of scope (cross-reference): regex/engine-level resource exhaustion patterns (DOS module, including NSRegularExpression input blowup); injection via interpreted languages (INJECTION); secrets in native binaries (SECRETS); dependency version auditing for known-vulnerable vendored libraries (track separately under A06:2021 – Vulnerable and Outdated Components).
• Objective: produce findings a maintainer can verify by reading two or three files — sink location, length origin, the missing or insufficient bound check, and worst-case attacker-controlled value — without requiring dynamic tooling.

Prerequisites & Vocabulary

Zero-background primer: the terms this module uses, one line each. Deeper plain-language explanations for every class live in the repository GUIDE.md glossary.