Avoid two panics during parsing #128
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If the next-hops length is u16::MAX, adding 8 (the PAYLOAD_OFFSET) to it would cause integer overflow and lead to a panic. Rather than switching to `saturating_add`, remove the addition entirely. It was unnecessary, as the provided length already accounts for the RTA struct.
`TcU32SelectorBuffer::new_checked` returns an error when the underlying buffer is not large enough to contain `nkeys`. This avoids an index-out-of-bounds panic in `TcU32Selector::parse`, when extracting keys from the underlying buffer.
bherrera
pushed a commit
to misttech/mist-os
that referenced
this pull request
Jul 30, 2024
This patch imports the following pull requests from GitHub: * rust-netlink/netlink-packet-route#128 * rust-netlink/netlink-packet-route#129 Fixed: b/353602659 Fixed: b/353775606 Change-Id: Ib209dbdaf09fb84f11b6ab9d2775a1284bbf360f Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1084502 Reviewed-by: Jeff Martin <martinjeffrey@google.com> Fuchsia-Auto-Submit: Brian Bosak <bbosak@google.com> Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>
bherrera
pushed a commit
to misttech/integration
that referenced
this pull request
Jul 30, 2024
This patch imports the following pull requests from GitHub: * rust-netlink/netlink-packet-route#128 * rust-netlink/netlink-packet-route#129 Original-Fixed: b/353602659 Original-Fixed: b/353775606 Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1084502 Original-Revision: 941d1385fc31291d5d1bdc6b50642c1fb7b70cf8 GitOrigin-RevId: 1c1169cc8a0f29231a9fc0664feda770eacf49a3 Change-Id: Ie70f1c3cbe5c60ac190d7251db11765cf9c87559
wllenyj
approved these changes
Aug 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The first occurs when checking the length of RouteNextHopBuffer.
If the next-hops length is u16::MAX, adding 8 (the PAYLOAD_OFFSET) to
it would cause integer overflow and lead to a panic. Rather than
switching to
saturating_add, remove the addition entirely. It wasunnecessary, as the provided length already accounts for the RTA struct.
The second occurs when parsing a TcU32Selector.
TcU32SelectorBuffer::new_checkedreturns an error when the underlyingbuffer is not large enough to contain
nkeys. This avoids anindex-out-of-bounds panic in
TcU32Selector::parse, when extractingkeys from the underlying buffer.