-
Notifications
You must be signed in to change notification settings - Fork 374
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix buffer overflow in HTC_RxInit on workspace exhaustion
HTC_RxInit could write a single '\0' NUL character outside of the
workspace when its called and there is zero bytes left in the
workspace. This would trigger the workspace canary causing subsequent
assertion.
Fix by releaving HTC_RxInit of adding the '\0' character.
HTC_RxStuff now returns HTC_S_Overflow early if the available buffer
space is zero. The '\0' character is inserted just before calling the
completion check function.
Also fix an off-by-one error on the http_{req|resp}_size calculations,
where the maximum number of bytes accepted was one less than the
paramter indicated. c00039.vtc and c00040.vtc has been edited to
reflect that and to be more expressive about the sizes they generate.
Fixes: #1834- Loading branch information
1 parent
23ca54d
commit 4bcc1c2
Showing
4 changed files
with
174 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| varnishtest "#1834 - Buffer overflow in backend workspace" | ||
|
|
||
| # This test case checks fetch side for buffer overflow when there is little | ||
| # workspace left. If failing it would be because we tripped the canary | ||
| # at the end of the workspace. | ||
|
|
||
| server s1 -repeat 64 { | ||
| rxreq | ||
| txresp | ||
| } -start | ||
|
|
||
| varnish v1 -vcl+backend { | ||
| import debug; | ||
| import std; | ||
|
|
||
| sub vcl_recv { | ||
| return (pass); | ||
| } | ||
|
|
||
| sub vcl_backend_fetch { | ||
| debug.workspace_allocate(backend, debug.workspace_free(backend) - std.integer(bereq.http.WS, 256)); | ||
| } | ||
| } -start | ||
|
|
||
| client c1 { | ||
| # Start with enough workspace to receive a good result | ||
| txreq -hdr "WS: 320" | ||
| rxresp | ||
| expect resp.status == 200 | ||
|
|
||
| # Continue with decreasing workspaces by decrements of 8 (sizeof void*) | ||
| txreq -hdr "WS: 312" | ||
| rxresp | ||
| txreq -hdr "WS: 304" | ||
| rxresp | ||
| txreq -hdr "WS: 296" | ||
| rxresp | ||
| txreq -hdr "WS: 288" | ||
| rxresp | ||
| txreq -hdr "WS: 280" | ||
| rxresp | ||
| txreq -hdr "WS: 272" | ||
| rxresp | ||
| txreq -hdr "WS: 264" | ||
| rxresp | ||
| txreq -hdr "WS: 256" | ||
| rxresp | ||
| txreq -hdr "WS: 248" | ||
| rxresp | ||
| txreq -hdr "WS: 240" | ||
| rxresp | ||
| txreq -hdr "WS: 232" | ||
| rxresp | ||
| txreq -hdr "WS: 224" | ||
| rxresp | ||
| txreq -hdr "WS: 216" | ||
| rxresp | ||
| txreq -hdr "WS: 208" | ||
| rxresp | ||
| txreq -hdr "WS: 200" | ||
| rxresp | ||
| txreq -hdr "WS: 192" | ||
| rxresp | ||
| txreq -hdr "WS: 184" | ||
| rxresp | ||
| txreq -hdr "WS: 176" | ||
| rxresp | ||
| txreq -hdr "WS: 168" | ||
| rxresp | ||
| txreq -hdr "WS: 160" | ||
| rxresp | ||
| txreq -hdr "WS: 152" | ||
| rxresp | ||
| txreq -hdr "WS: 144" | ||
| rxresp | ||
| txreq -hdr "WS: 136" | ||
| rxresp | ||
| txreq -hdr "WS: 128" | ||
| rxresp | ||
| txreq -hdr "WS: 120" | ||
| rxresp | ||
| txreq -hdr "WS: 112" | ||
| rxresp | ||
| txreq -hdr "WS: 104" | ||
| rxresp | ||
| txreq -hdr "WS: 096" | ||
| rxresp | ||
| txreq -hdr "WS: 088" | ||
| rxresp | ||
| txreq -hdr "WS: 080" | ||
| rxresp | ||
| txreq -hdr "WS: 072" | ||
| rxresp | ||
| txreq -hdr "WS: 064" | ||
| rxresp | ||
| txreq -hdr "WS: 056" | ||
| rxresp | ||
| txreq -hdr "WS: 048" | ||
| rxresp | ||
| txreq -hdr "WS: 040" | ||
| rxresp | ||
| txreq -hdr "WS: 032" | ||
| rxresp | ||
| txreq -hdr "WS: 024" | ||
| rxresp | ||
| txreq -hdr "WS: 016" | ||
| rxresp | ||
| txreq -hdr "WS: 008" | ||
| rxresp | ||
| txreq -hdr "WS: 000" | ||
| rxresp | ||
| } -run |