Use cxplat safe integer helpers by Alan-Jowett · Pull Request #5200 · microsoft/ebpf-for-windows

Alan-Jowett · 2026-04-23T18:50:56Z

Summary

migrate overflow-sensitive API buffer sizing and batch offset math to cxplat safe integer helpers
use checked arithmetic in user and kernel ring-buffer sizing paths
update the user-mode RtlULongAdd mock to report integer overflow instead of doing unchecked addition

Validation

msbuild /m /p:Configuration=Debug /p:Platform=x64 ebpf-for-windows.sln
x64\Debug\unit_tests.exe (existing end-to-end/program-loading failures in this environment)

Tracking

github-actions · 2026-04-23T18:51:35Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-23T19:11:25Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-23T19:56:12Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-23T21:37:44Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-23T23:32:54Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-23T23:54:50Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-23T23:55:08Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-24T00:28:24Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

Copilot

Pull request overview

This PR migrates several overflow-sensitive size/offset calculations across user-mode, kernel-mode, service, and extension components to cxplat/ebpf_safe_* checked-integer helpers, reducing the risk of integer overflow leading to undersized allocations or buffer math errors.

Changes:

Replace unchecked +/* sizing math with ebpf_safe_size_t_* / cxplat_safe_* helpers across API buffers, map/program structures, ring-buffer sizing, and serialization paths.
Tighten protocol/offset computations (including uint16_t protocol length constraints) and improve overflow handling/reporting in multiple IOCTL request/reply builders.
Update user-mode RtlULongAdd mock to correctly report STATUS_INTEGER_OVERFLOW on overflow.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
netebpfext/net_ebpf_ext.h	Updates SAL annotation to express returned filter-id buffer size in bytes.
netebpfext/net_ebpf_ext.c	Uses checked sizing for allocations and replaces index-based writes with pointer-advance for filter-id recording.
libs/ubpf/user/ubpf_user.c	Routes `calloc` through checked multiplication before allocation.
libs/ubpf/kernel/ubpf_kernel.c	Routes `calloc` through checked multiplication before allocation (kernel build).
libs/store_helper/user/ebpf_registry_helper.cpp	Adds checked sizing for UTF-8→wide conversions, registry string length math, and GUID substring copy.
libs/shared/shared_common.c	Uses checked multiplication for helper prototype array allocation sizing.
libs/shared/ebpf_shared_framework.h	Adds `ebpf_safe_*` wrappers for multiple integer widths.
libs/shared/ebpf_serialize.c	Uses checked addition for pin-path allocation sizing and formatting cleanups.
libs/service/api_service.cpp	Uses checked sizing for helper/map resolve request/reply protocol buffers.
libs/runtime/user/kernel_um.cpp	Updates `RtlULongAdd` mock to detect/report overflow.
libs/runtime/user/ebpf_platform_user.cpp	Uses checked arithmetic for ring-buffer section/view sizing and related Win32 APIs.
libs/runtime/kernel/ebpf_platform_kernel.c	Uses checked arithmetic for ring-buffer MDL sizing and UTF-8 path conversion sizing.
libs/runtime/ebpf_trampoline.c	Uses checked multiplication for trampoline table memory mapping size.
libs/runtime/ebpf_platform.h	Adds new `ebpf_interlocked_increment_uint32` API declaration.
libs/runtime/ebpf_platform.c	Uses checked sizing for UTF-8→unicode allocation and formatting cleanup.
libs/runtime/ebpf_pinning_table.c	Uses checked multiplication for pinning entry array allocation sizing.
libs/runtime/ebpf_object.c	Switches object ID assignment to `ebpf_interlocked_increment_uint32`.
libs/runtime/ebpf_interlocked.c	Implements `ebpf_interlocked_increment_uint32`.
libs/runtime/ebpf_hash_table.c	Uses checked arithmetic for bucket entry offset/size computations and bucket resize math.
libs/runtime/ebpf_epoch.c	Uses checked sizing for epoch allocation headers and fixes message-type bounds check.
libs/runtime/ebpf_bitmap.c	Uses checked arithmetic (asserted) for bitmap sizing and initialization memset length.
libs/execution_context/ebpf_program.c	Uses checked sizing for map association buffers, helper-id/address arrays, instruction byte sizing, and related allocations.
libs/execution_context/ebpf_native.c	Uses checked sizing for native module arrays (maps/programs/helpers/handles/addresses/global variable sections).
libs/execution_context/ebpf_maps.c	Uses checked offset math for array map entry access and several map structure size computations; hardens batch-copy math.
libs/execution_context/ebpf_core_jit.c	Uses checked subtraction/addition/multiplication for request parsing and resolve helper/map reply sizing.
libs/execution_context/ebpf_core.c	Uses checked protocol name-length math, batch key/value sizing, reply-length computations, and hardens printk format parsing bounds.
libs/api_common/windows_platform_common.cpp	Uses checked multiplication/copy bounds when expanding helper prototype arrays.
libs/api_common/store_helper_internal.cpp	Uses checked sizing for registry helper-name buffers, helper prototype arrays, and vector-to-array copies.
libs/api_common/api_common.cpp	Uses checked instruction byte sizing and request/reply buffer sizing for object info queries.
libs/api/windows_platform.cpp	Uses checked arithmetic for map-section record indexing/offset computations.
libs/api/ebpf_api.cpp	Adds local safe-math helpers and uses checked sizing throughout multiple request/reply buffer builders and batch path computations.
libs/api/Verifier.cpp	Uses checked sizing when materializing verifier error strings.
ebpfcore/ebpf_drv.c	Uses checked sizing for ACL construction and enforces protocol buffer length limits at device-control entry.

github-actions · 2026-04-24T01:07:44Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

github-actions · 2026-04-24T01:22:21Z

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 36 out of 36 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

libs/api_common/api_common.cpp:33

allocate_string() casts string_length (size_t) into a uint32_t when writing *length. If string_length exceeds UINT32_MAX, this silently truncates and can break callers that rely on the reported length. Add a bounds check (string_length <= UINT32_MAX) and fail (return nullptr) or otherwise handle the oversized case before assigning to *length.

    if (new_string != nullptr) {
        strcpy_s(new_string, string_length, string.c_str());
        if (length != nullptr) {
            *length = (uint32_t)string_length;
        }

Copilot

Pull request overview

Copilot reviewed 36 out of 36 changed files in this pull request and generated 3 comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…idate Use ebpf_assert_assume instead of ebpf_assert for the backup_bucket NULL check so that __analysis_assume tells the static analyzer the pointer is non-NULL after this point. In Release builds ebpf_assert expands to (void)(x) which does not suppress the C6011/C6387 warnings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…r-cxplat-migration # Conflicts: # libs/api_common/store_helper_internal.cpp # libs/shared/ebpf_serialize.c # netebpfext/net_ebpf_ext.c

Alan-Jowett force-pushed the feature/safe-integer-cxplat-migration branch from 6d1bd4c to d4da37f Compare April 23, 2026 23:54

Alan-Jowett requested a review from Copilot April 24, 2026 00:59

Copilot started reviewing on behalf of Alan-Jowett April 24, 2026 01:00 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread netebpfext/net_ebpf_ext.c Outdated

Alan-Jowett requested a review from Copilot April 24, 2026 01:29

Copilot started reviewing on behalf of Alan-Jowett April 24, 2026 01:30 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread libs/api_common/windows_platform_common.cpp Outdated

Alan-Jowett requested a review from Copilot April 24, 2026 02:23

Copilot started reviewing on behalf of Alan-Jowett April 24, 2026 02:24 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread libs/runtime/ebpf_bitmap.c

Comment thread libs/runtime/ebpf_bitmap.c Outdated

Alan-Jowett requested a review from Copilot April 24, 2026 04:59

Copilot started reviewing on behalf of Alan-Jowett April 24, 2026 05:00 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread libs/execution_context/ebpf_maps.c

Comment thread libs/execution_context/ebpf_maps.c

Comment thread libs/execution_context/ebpf_program.c Outdated

Comment thread libs/runtime/ebpf_hash_table.c Outdated

Alan-Jowett requested a review from Copilot April 24, 2026 15:11

Copilot started reviewing on behalf of Alan-Jowett April 24, 2026 15:12 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread libs/api/ebpf_api.cpp

Comment thread libs/api/ebpf_api.cpp

Comment thread libs/runtime/ebpf_hash_table.c

Alan-Jowett marked this pull request as ready for review April 27, 2026 15:04

Alan-Jowett requested review from LakshK98, dthaler and matthewige as code owners April 27, 2026 15:04

Alan-Jowett and others added 9 commits April 30, 2026 08:30

Fix execution context regressions

64f97bf

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix overlapping client context copy

2d69424

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove unused helper copy size

01e54f8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Harden bitmap overflow handling

0f92eb3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix latest PR review findings

402c904

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix API batch loop guards

da62116

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix netebpfext client removal compaction

15f93db

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Refine API overflow error handling

77c5e69

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix remaining PR 5200 review findings

f78bfa2

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Alan-Jowett force-pushed the feature/safe-integer-cxplat-migration branch from 8373393 to f78bfa2 Compare April 30, 2026 15:30

mikeagun reviewed Apr 30, 2026

View reviewed changes

Comment thread libs/api/ebpf_api.cpp Outdated

Comment thread libs/api/ebpf_api.cpp

Guard API protocol length narrowing

5f82066

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

mikeagun previously approved these changes Apr 30, 2026

View reviewed changes

Merge upstream main into safe integer helper branch

ae65e88

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Alan-Jowett dismissed mikeagun’s stale review via ae65e88 May 1, 2026 15:12

mikeagun approved these changes May 1, 2026

View reviewed changes

Alan-Jowett enabled auto-merge May 1, 2026 16:01

Merge branch 'main' into feature/safe-integer-cxplat-migration

5b4f52d

mikeagun previously approved these changes May 4, 2026

View reviewed changes

Alan-Jowett added 2 commits May 5, 2026 12:21

Merge branch 'main' into feature/safe-integer-cxplat-migration

a339bf4

Merge branch 'main' into feature/safe-integer-cxplat-migration

981e0dd

saxena-anurag reviewed May 7, 2026

View reviewed changes

Comment thread netebpfext/net_ebpf_ext.c

Comment thread libs/runtime/ebpf_bitmap.c Outdated

Comment thread libs/api_common/api_common.cpp

Comment thread libs/api_common/store_helper_internal.cpp

saxena-anurag reviewed May 7, 2026

View reviewed changes

Comment thread libs/execution_context/ebpf_maps.c

Comment thread libs/execution_context/ebpf_program.c

Merge upstream/main into feature/safe-integer-cxplat-migration

7ff4cdb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Alan-Jowett dismissed mikeagun’s stale review via 7ff4cdb May 8, 2026 15:34

saxena-anurag reviewed May 12, 2026

View reviewed changes

Comment thread libs/runtime/ebpf_hash_table.c

Alan-Jowett and others added 4 commits May 12, 2026 08:51

Preserve PRE_FREE delete semantics

5e773aa

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge upstream/main into feature/safe-integer-cxplat-migration

08926b4

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge remote-tracking branch 'upstream/main' into feature/safe-intege…

49c2af1

…r-cxplat-migration # Conflicts: # libs/api_common/store_helper_internal.cpp # libs/shared/ebpf_serialize.c # netebpfext/net_ebpf_ext.c

Conversation

Alan-Jowett commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Tracking

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Alan-Jowett commented Apr 23, 2026 •

edited

Loading