Skip to content

Sending data cause memory overflow when UDP_SEGMENT macro failed to import #5098

Open
@baiyesong

Description

@baiyesong

Describe the bug

The background of the problem is #5095

Affected OS

  • Windows
  • Linux
  • macOS
  • Other (specify below)

Additional OS information

Linux system: Centos8
Kernel version: 4.18
cmake version: 3.20
msquic version: 2.4.7

Linux system: Ubuntu22.04
Kernel version: 6.5
cmake version: 3.20
msquic version: 2.4.7

MsQuic version

main

Steps taken to reproduce bug

more info can see in #5095

Compilation stage
The only difference between the compilation in CentOS and that in Ubuntu is

-- Looking for UDP_SEGMENT
-- Looking for UDP_SEGMENT - not found

Its location in the CMakeList
check_symbol_exists(UDP_SEGMENT netinet/udp.h HAS_UDP_SEGMENT)

The commands I used during the runtime stage are

./secnetper -port:8500
./secnetper -target:localhost -port:8500 -cc:bbr -exec:maxtput -up:134217728 -conns:1 -streams:1 -ptput:1

Expected behavior

I compiled the msquic-2.4.7 source code on the CentOS8 system. After configuring the environment, the compilation was successful . Subsequently, an error occurred during local runtime. When I copied the same code to the Ubuntu system, it ran successfully without errors.

Actual outcome

more info can see in #5095

Additional details

Through experiments, msquic will by default get the UDP_SEGMENT macro from the /usr/include/netinet/udp.h file (this is the path in both Ubuntu and CentOS8), which is defined as

#define UDP_SEGMENT 103

As shown in the CMakeList filecheck_symbol_exists(UDP_SEGMENT netinet/udp.h HAS_UDP_SEGMENT)
msquic uses the UDP_SEGMENT in the./src/platform/datapath_epoll.c file.


In CentOS 8, the /usr/include/netinet/udp.hfile does not contain UDP_SEGMENT.
the UDP_SEGMENT macro is defined in

/usr/include/linux/udp.h
/usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/include/uapi/linux/udp.h

This results in the UDP_SEGMENT not being recognizable during the compilation and runtime phases in CentOS8.
Moreover, the code of the msquic-2.4.7 version has a bug in the logic for handling the absence of UDP_SEGMENT, which leads to a memory out-of-bounds error during the runtime phase.

When I disabled the UDP_SEGMENT macro in the Ubuntu system (by adding #undef UDP_SEGMENT at the beginning of datapath_epoll.c), the same error occurred in Ubuntu! The following attachment contains the detailed error information after disabling the UDP_SEGMENT.

Ubuntu-GDB.txt
Ubuntu-Valgrind.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions