This is an automated email from the ASF dual-hosted git repository. cmcfarlen pushed a commit to branch 10.2.x in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 641d15d07a8a041b0bff08abc3d08208fe4b7979 Author: Brian Olsen <[email protected]> AuthorDate: Tue Jun 16 06:25:34 2026 -0600 Fix bounds check in CacheVC::scanObject (#13263) (cherry picked from commit dd38491fd5ae9aeaa1dee414bcc7359efcc2247a) --- src/iocore/cache/CacheVC.cc | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/iocore/cache/CacheVC.cc b/src/iocore/cache/CacheVC.cc index 54a7abc739..8dc154a887 100644 --- a/src/iocore/cache/CacheVC.cc +++ b/src/iocore/cache/CacheVC.cc @@ -769,9 +769,17 @@ CacheVC::scanObject(int /* event ATS_UNUSED */, Event * /* e ATS_UNUSED */) } break; } - if (doc->data() - buf->data() > static_cast<int>(io.aiocb.aio_nbytes)) { - might_need_overlap_read = true; - goto Lskip; + { + size_t const doc_off = reinterpret_cast<char *>(doc) - buf->data(); + // Bounds-check in unsigned domain: doc must lie within the + // buffer, with room for the Doc header, and doc->hlen must + // fit in the remaining bytes before doc->hdr() and + // HTTPInfo::unmarshal walk it. + if (io.aiocb.aio_nbytes < doc_off || (io.aiocb.aio_nbytes - doc_off) < sizeof(Doc) || + (io.aiocb.aio_nbytes - doc_off - sizeof(Doc)) < doc->hlen) { + might_need_overlap_read = true; + goto Lskip; + } } { char *tmp = doc->hdr();
