msg/msg_types: fix the entity_addr_t's decoder #17699
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
liewegas
reviewed
Sep 13, 2017
src/msg/msg_types.h
Outdated
| @@ -456,7 +456,8 @@ struct entity_addr_t { | |||
| __u32 elen; | |||
| ::decode(elen, bl); | |||
| if (elen) { | |||
| bl.copy(elen, (char*)get_sockaddr()); | |||
| bl.copy(std::min((size_t)elen, get_sockaddr_len()), | |||
| (char*)get_sockaddr()); | |||
There was a problem hiding this comment.
would it make more sense to throw buffer::error if elen > get_sockaddr_len()? That seems better than partially decoding the (bogus) input.
There was a problem hiding this comment.
@liewegas makes sense, i will check all the caller sites , and add the error handling code if necessary.
|
introduced by 6a7fe5a |
tchaikov
force-pushed
the
wip-lookout-for-large-elen
branch
from
854aba5
to
c23a326
Compare
|
@liewegas fixed and repushed. |
tchaikov
force-pushed
the
wip-lookout-for-large-elen
branch
from
c23a326
to
01ba79f
Compare
liewegas
approved these changes
Sep 13, 2017
the daemon is vulnerable to malicious client, which is able to send large elen, and corrupt the stack, etc. * throw at seeing corrupted entity_addr_t where its elen exceeds the length of sockaddr * handle the exception thrown when decoding entity_addr_t in messenger layer. * if a malicious client manages to send a corrutped entity_addr_t to daemon, daemon will crash because decode fails and the exception is not handled. it's better than continuing working with the bogus message. Signed-off-by: Kefu Chai <kchai@redhat.com>
tchaikov
force-pushed
the
wip-lookout-for-large-elen
branch
from
01ba79f
to
aa83c2c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
the daemon is vulnerable to malicious client, which is able to send
large elen, and corrupt the stack, etc.
Signed-off-by: Kefu Chai kchai@redhat.com