Repository navigation
Don't overflow the bit buffer printing Cd data in binary ##crash - #27322
Merged
Merged
Conversation
With a binary immbase, ds_print_data_type passed size * 8 bits to r_str_bits with a 64 byte msg and an 8 byte copy of the item: an 8 byte item wrote one byte past msg, and a 31 byte .smi item wrote 249 bytes and read past buf (stack smashing detected). Size msg for 64 bits and the NUL, and fall back to the hexdump for items over 8 bytes.
Collaborator
|
Good to merge. This fixes both the missing NUL byte and the out-of-bounds read for Separate followups:
|
2 of 3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
With a binary immbase (
ahi 1),ds_print_data_typeprints aCditem bit by bit withr_str_bits (msg, buf, size * 8, NULL).msgwaschar msg[64], andbufonly holds the first 8 bytes of the item:msg;.smi), it wrote 249 bytes intomsgand read 31 bytes from the 8-bytebuf.wx 0102030405060708; Cd 31; ahi 1; pd 1aborts with*** stack smashing detected ***.msgnow holds 64 bits plus the NUL. Items larger than 8 bytes fall back to the hexdump, which is whatpdalready shows forCd 31without the hint.#27320 moves this code into a helper. I'll rebase whichever of the two lands second.
Testing
Two tests in
test/db/cmd/metadata:The 8-byte test passes on master too, because a build without ASan does not notice the one extra byte.