Crash when using ErrorDebugString with non-null-terminated string

[thezayas]

Describe the bug

We are encountering a crash in production when using ErrorDebugString(int error) from AWS CRT C++.

The function returns a const char*, but in some cases the returned string appears to not be null-terminated, which leads to undefined behavior when used with std::string.

Code Snippet

const char* err = ErrorDebugString(errorCode);

std::string result = "";
result = err;  // <-- crash originates here
result += ", HTTP Status code: " + std::to_string(httpResponseCode);

Observed Behavior

• Crash occurs during std::string assignment or concatenation

• Call stack indicates failure inside:

    - std::string::assign
    - std::char_traits<char>::assign
  

Full code below

std::tuple<int, int, std::string> AwsIoTDeviceProxy::GetThingShadow(const std::string& deviceId, const std::string& shadowName, AuthenticationSettings authenticationSettings, bool isAuthProxy, bool isImpersonate, bool isValidNTLMVersion, UseTimerType eTimerType)
{
    int connectionCode = -1, httpStatusCode = 0;
    std::string shadow = "", result = "";

    HP::Shared::Semaphore semGetThingShadow;

    //handler to receive call back on publish event
    auto OnGetThingShadow = [this, &connectionCode, &httpStatusCode, &shadow, &result, &semGetThingShadow](std::string response, int errorCode, int httpResponseCode) -> void
        {
            //Signal the waiting caller
            SCOPE_GUARD{ connectionCode = errorCode; httpStatusCode = httpResponseCode; shadow = response;  semGetThingShadow.Post(); };

            fprintf(stderr, "OnGetThingShadow Response: %s\n", ErrorDebugString(errorCode));
            fprintf(stderr, "OnGetThingShadow Status: %d\n", httpResponseCode);

            if (errorCode)
            {
                result = ErrorDebugString(errorCode);
                result += ", HTTP Status code: " + std::to_string(httpResponseCode);

                LogError << "Error while OnGetThingShadow - ResponseCode: " << httpResponseCode << ", ErrorCode: " << errorCode << ", Response: " << (response.empty() ? "Empty" : response);
                LogError << "Error while OnGetThingShadow, Error Message: " << ErrorDebugString(errorCode);
            }
            else
            {
                result = "Operation successful";
                if (httpResponseCode == static_cast<int>(HttpUtility::Http::Status::OK))
                {
                    LogInfo << "OnGetThingShadow successful.";
                }
                else
                {
                    LogError << "Error while OnGetThingShadow: " << httpResponseCode << " response" << response;
                }
            }
        };

Expected Behavior

• Returned string from ErrorDebugString() should be:

  • Properly null-terminated

  OR
  

  • API should document that the string may not be null-terminated

Current Behavior

Reproduction Steps

Possible Solution

No response

Additional Information/Context

No response

SDK version used

V2

Environment details (OS name and version, etc.)

Operating System: Microsoft Windows 11 Enterprise | 64-bit Build Number: 26100 ServicePack: 0

[sfod]

Do you have this crash with the errorCode 1052? I just checked, its message is null-terminated.

[sfod]

In your code snippet, how exactly do you use the lambda you create? Could you provide the rest of the AwsIoTDeviceProxy::GetThingShadow function?
From what I see, you capture local variables connectionCode, httpStatusCode, shadow, and result in the lambda by reference. So, if the lambda is called after GetThingShadow returns, you'll get a use-after-free issue. Considering that your app crashes on an attempt to use result, I'd verify first that result is still alive.

[github-actions]

Greetings! It looks like this issue hasn’t been active in longer than a week. We encourage you to check if this is still an issue in the latest release. Because it has been longer than a week since the last update on this, and in the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or add an upvote to prevent automatic closure, or if the issue is already closed, please feel free to open a new one.

[rakshil14-2]

Hey @thezayas, Can you provide how exactly do you use lambda and also provide rest of the AwsIoTDeviceProxy::GetThingShadow function?