storage: avoid buffer bleed when reading past the end of the file #1439
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
`bytes_read == 0` is an EOF condition. If we failed to read anything, better to zero out the buffer explicitly, like we do for other failure cases, so that the caller doesn't see "garbage" data that was there before. This _shouldn't_ matter in practice, as the caller always verifies the checksum anyway, but still feels like a good defense in depth.
|
Found this one live at https://youtu.be/THWDx_RyZ6A! |
matklad
commented
Jan 18, 2024
| @@ -299,7 +300,8 @@ pub const Storage = struct { | |||
| // - Another replica requested a block, but we are lagging far behind, and the block address | |||
| // requested is beyond the end of our data file. | |||
| if (bytes_read == 0) { | |||
| read.callback(read); | |||
| @memset(read.buffer, 0); | |||
| self.start_read(read, read.buffer.len); | |||
There was a problem hiding this comment.
Going through start_read rather then directly invoking callback to have "a single return" from the async loop.
sentientwaffle
approved these changes
Jan 18, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
bytes_read == 0is an EOF condition. If we failed to read anything, better to zero out the buffer explicitly, like we do for other failure cases, so that the caller doesn't see "garbage" data that was there before.This shouldn't matter in practice, as the caller always verifies the checksum anyway, but still feels like a good defense in depth.