ubeddulla opened a new pull request, #3605:
URL: https://github.com/apache/brpc/pull/3605
### What problem does this PR solve?
Issue Number:
Problem Summary:
On the UBRing handshake, `HelloMessage::Deserialize` copies the 48-byte
`shm_name` straight from the peer's HELLO message and never terminates it. A
peer that fills every byte of `SHM_MAX_NAME_BUFF_LEN` with non-zero data leaves
the field without a `'\0'`, and the server side then treats it as a C-string:
`strncpy` into same-size buffers, `strrchr`, `snprintf("%s", client_name)`, and
the shm allocate/map/log calls in `shm_ubs.cpp` all walk past the 48-byte
buffer. Under ASAN this is a stack-buffer-overflow READ in `strrchr` on
`client_name`. `SHM_MAX_NAME_LEN` is defined as `SHM_MAX_NAME_BUFF_LEN - 1`, so
a conforming name already leaves room for the terminator; only a malformed or
hostile name reaches this.
### What is changed and the side effects?
Changed:
`HelloMessage::Deserialize` sets `shm_name[SHM_MAX_NAME_BUFF_LEN - 1] =
'\0'` after the copy so the decoded name is always a valid C-string within the
buffer. Names of 47 bytes or fewer are unchanged.
`HelloMessageTest.full_shm_name` now asserts the decoded name is terminated; it
fails on the current tree and passes with this change.
Side effects:
- Performance effects: none.
- Breaking backward compatibility: none; a conforming peer already sends a
terminated name.
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
