nvtable: deserialized handle access crash #1967
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The deserialization process for nvtable has two stages. The first one is to read the byte stream and assign it to a structure, The second phase called `fixup`, which tries to fix the index tables (both static and dynamic). The fixup process checks if the handles are valid, and current. If they are not, it replaces them with a new valid handle. The current issue is that the fixup function created a temporary table for all of the index, and saved all of the updated handles in this new table. If there was even one new handle, it swaped the two table. But in fact if there was a handle that did not required update, it was not saved to the new table, thus that space left uninitialized. Thus it could crash based on the memory trash. Signed-off-by: kokan <peter.kokai@balabit.com>
|
success |
furiel
approved these changes
Apr 7, 2018
|
This looks good to me. Very nice catch. To get the crash we need to have some of the handles match and some that don't. |
bazsi
approved these changes
Apr 7, 2018
Kokan
added a commit
to Kokan/syslog-ng
that referenced
this pull request
Jun 6, 2018
The syslog-ng#1967 was not a complete fix, because that fixed the case with nvtable. But that did not fix the one with sdata. Signed-off-by: Kokan <kokaipeter@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This crash happens, when a message is deserialized. (An example for this is the disk queue file.)
The deserialization process has two steps. One that actually make the deserialization, and an additional fixup step.
The additional fixup step tries to validate and updated the index table with the new handles (if they are new).
The issue comes from this fixup, because first it creates a temporary index table, if a handle has a new handle it saves the updated entry to the temporary table.
After going through all of the entries, if there was even one updated entry it just swaps the two table (temporary, and active).
The issue here, that when there were some handle which has been updated, and there were some that have not, the temporary table has gaps with uninitialized entities.
This probably Fixes #1919.