This repository was archived by the owner on Feb 16, 2026. It is now read-only.
Repository navigation
Conversation
Member
Author
|
@dridi
|
Member
|
IMO the correct fix is to ensure that GetStorage never returns a size larger than what we asked for, but might be more complicated than that. |
Member
|
Testcase (with ASAN): |
Member
|
Test output (panic only): |
mbgrydeland
added a commit
to mbgrydeland/varnish-cache
that referenced
this pull request
Sep 18, 2017
The file stevedore may return a buffer larger than asked for when requesting storage. Due to lack of check for this condition, the code to copy the synthetic error memory buffer from vcl_error would overrun the buffer. Fixes: varnishcache#2429
Member
|
@shamger Thanks for the pull request. As you can see, @mbgrydeland has commited the fix you proposed, and I have back ported it to 4.1 as 19a7318. |
mbgrydeland
added a commit
that referenced
this pull request
Nov 14, 2017
mbgrydeland
added a commit
that referenced
this pull request
Nov 14, 2017
mbgrydeland
added a commit
that referenced
this pull request
Nov 14, 2017
|
This is CVE-2017-8807 |
Contributor
|
This is Varnish Security Vulnerability VSV00002. See https://varnish-cache.org/security/VSV00002.html for details. |
dmatetelki
pushed a commit
to dmatetelki/varnish-cache
that referenced
this pull request
Mar 14, 2019
The file stevedore may return a buffer larger than asked for when requesting storage. Due to lack of check for this condition, the code to copy the synthetic error memory buffer from vcl_error would overrun the buffer. Patch by @shamger Fixes: varnishcache#2429
dmatetelki
pushed a commit
to dmatetelki/varnish-cache
that referenced
this pull request
Mar 14, 2019
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See the code in vbf_stp_error(cache_fetch.c). The variable of l is the storage size that has been got, while ll is the length of VSB_data(synth_body).
In this case, the third parameter of memcpy is 4096, but the actual length of VSB_data(synth_body) is only 284. If the memory address from VSB_data(synth_body)+284 is unavailable, coredump will occur!