BUGs found

[LeoneChen]

Stack overflow

buf is only 256 size, but vsnprintf can write up to BUFSIZ, cause stack overflow

BiORAM-SGX/Enclave/Enclave.cpp

Lines 104 to 113 in 6e8df40

	int printf(const char* fmt, ...)
	{
	char buf[256] = { '\0' };
	va_list ap;
	va_start(ap, fmt);
	vsnprintf(buf, BUFSIZ, fmt, ap);
	va_end(ap);
	ocall_print_string(buf);
	return (int)strnlen(buf, BUFSIZ - 1) + 1;
	}

Null Pointer Dereference

Although ptr is in, when it is null, TBridge will pass it to real ecall

BiORAM-SGX/Enclave/Enclave.edl

Line 33 in 6e8df40

public void cp_source([in, size=len]void *ptr, size_t len);

But in cp_source, not check ptr is not null

BiORAM-SGX/Enclave/Enclave.cpp

Lines 1052 to 1056 in 6e8df40

	void cp_source(void *ptr, size_t len)
	{
	std::string sc = (const char*)ptr;
	printf("%s", sc.c_str());
	}