getUUID allows the user to read unintialised memory

[weissi]

postgres-nio/Sources/PostgresNIO/Utilities/NIOUtils.swift

Lines 110 to 128 in bfc0a99

	func getUUID(at index: Int) -> UUID? {
	precondition(index >= 0, "index must not be negative")
	return self.withVeryUnsafeBytes { ptr in
	guard index <= ptr.count - MemoryLayout<uuid_t>.size else {
	return nil
	}
	var value: uuid_t = (0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)
	withUnsafeMutableBytes(of: &value) { valuePtr in
	valuePtr.copyMemory(
	from: UnsafeRawBufferPointer(
	start: ptr.baseAddress!.advanced(by: index),
	count: MemoryLayout<UUID>.size
	)
	)
	}
	return UUID(uuid: value)
	}
	}
	}

The code above allows the user to read uninitialised memory which is a security vulnerability.

A better way to write this function is

    func getUUID(index: Int) -> UUID? {
        var uuid: uuid_t = (0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)
        return self.viewBytes(at: index, length: MemoryLayout.size(ofValue: uuid)).map { bufferBytes in
            withUnsafeMutableBytes(of: &uuid) { target in
                precondition(target.count <= bufferBytes.count)
                target.copyBytes(from: bufferBytes)
            }
            return UUID(uuid: uuid)
        }
    }