Daily updates from Odoo
Friday, October 27, 2023
1 change
Security fixes and vulnerability patches
This fix addresses a critical memory safety vulnerability in the Worldline payment interface where string data was being handled incorrectly between Python and C++ code. The issue could potentially cause system crashes or data corruption. The fix corrects how strings are copied to prevent buffer overflow errors.
Original PR description
This fix aims to remove an issue present in current Worldline interface and driver related to the way we work with strings between Python and C++. Currently, we are creating string buffers in Python (char *) and passing pointers to them (char **) to our C++ Worldline EasyCTEP library. Then inside our C++ code we copy a string inside that pointer (char **). This is a mistake which can easily lead to a buffer overflow, we need to copy strings inside the buffers and not pointers to them. task-3562527 Replaces the closed PR: [49242](https://github.com/odoo/enterprise/pull/49242) Forward-Port-Of: odoo/enterprise#49387