RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-11 03:31:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MAJOR: buf: fix varint API post- vs pre- increment

Browse Source 
A bogus test in b_get_varint(), b_put_varint(), b_peek_varint() shifts
the end of the buffer by one byte. Since the bug is the same in the read
and write functions, the buffer contents remain compatible, which explains
why this bug was not detected earlier. But if the buffer ends on an
aligned address or page, it can result in a one-byte overflow which will
typically cause a crash or an inconsistent behavior.

This API is only used by rings (e.g. for traces and boot messages) and
by DNS responses, so the probability to hit it is extremely low, but a
crash on boot was observed.

This must be backported to 2.2.
This commit is contained in:
Willy Tarreau 2021-10-21 15:05:34 +02:00
parent dcb696cd31
commit dd362b7b24
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/haproxy/buf.h
View File

@ -763,7 +763,7 @@ static inline void __b_put_varint(struct buffer *b, uint64_t v)
v = (v - 0xF0) >> 4;
while (1) {
if (tail++ == wrap)
if (++tail == wrap)
tail -= size;
data++;
if (v < 0x80)
@ -798,7 +798,7 @@ static inline int b_put_varint(struct buffer *b, uint64_t v)
v = (v - 0xF0) >> 4;
while (1) {
if (tail++ == wrap)
if (++tail == wrap)
tail -= size;
data++;
if (data == size || v < 0x80)
@ -837,7 +837,7 @@ static inline int b_get_varint(struct buffer *b, uint64_t *vptr)
v = *head;
bits += 4;
while (1) {
if (head++ == wrap)
if (++head == wrap)
head -= size;
data--;
if (!data || !(*head & 0x80))
@ -879,7 +879,7 @@ static inline int b_peek_varint(struct buffer *b, size_t ofs, uint64_t *vptr)
v = *head;
bits += 4;
while (1) {
if (head++ == wrap)
if (++head == wrap)
head -= size;
data--;
if (!data || !(*head & 0x80))