This is an automated email from the ASF dual-hosted git repository.
chenBright pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brpc.git
The following commit(s) were added to refs/heads/master by this push:
new 8d1523f2 null-terminate peer shm_name in HelloMessage::Deserialize
(#3605)
8d1523f2 is described below
commit 8d1523f2bc844617d4a380bab4b87781d3318dff
Author: UB <[email protected]>
AuthorDate: Sun Oct 18 08:16:42 2026 +0530
null-terminate peer shm_name in HelloMessage::Deserialize (#3605)
---
src/brpc/ubshm/ub_endpoint.cpp | 5 +++++
test/brpc_ubring_unittest.cpp | 11 ++++++++++-
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/src/brpc/ubshm/ub_endpoint.cpp b/src/brpc/ubshm/ub_endpoint.cpp
index ec7e0842..97e39e5d 100644
--- a/src/brpc/ubshm/ub_endpoint.cpp
+++ b/src/brpc/ubshm/ub_endpoint.cpp
@@ -144,6 +144,11 @@ void HelloMessage::Deserialize(void* data) {
len = butil::NetToHost64(net_len);
current_pos += sizeof(net_len);
memcpy(shm_name, current_pos, SHM_MAX_NAME_BUFF_LEN);
+ // shm_name arrives verbatim from the peer and is used downstream as a
+ // C-string (strncpy/strrchr/snprintf("%s")/shm allocate+map). A peer that
+ // fills all SHM_MAX_NAME_BUFF_LEN bytes without a terminator would make
+ // those scans run past the buffer, so force termination here.
+ shm_name[SHM_MAX_NAME_BUFF_LEN - 1] = '\0';
}
std::string HelloMessage::toString() const {
diff --git a/test/brpc_ubring_unittest.cpp b/test/brpc_ubring_unittest.cpp
index c9b9c91d..558c6966 100644
--- a/test/brpc_ubring_unittest.cpp
+++ b/test/brpc_ubring_unittest.cpp
@@ -744,6 +744,11 @@ TEST_F(HelloMessageTest, large_len_value) {
}
TEST_F(HelloMessageTest, full_shm_name) {
+ // A peer that fills every byte of shm_name leaves no terminator on the
+ // wire. Deserialize must still hand back a valid C-string, because the
+ // handshake feeds the decoded name straight into strncpy/strrchr/
+ // snprintf("%s") and the shm allocate/map calls; without a terminator
+ // those scan past shm_name.
memset(msg.shm_name, 'A', SHM_MAX_NAME_BUFF_LEN);
msg.msg_len = 64;
msg.hello_ver = 2;
@@ -755,7 +760,11 @@ TEST_F(HelloMessageTest, full_shm_name) {
memset(&decoded, 0, sizeof(decoded));
decoded.Deserialize(&buffer[0]);
- EXPECT_EQ(0, memcmp(msg.shm_name, decoded.shm_name,
SHM_MAX_NAME_BUFF_LEN));
+ EXPECT_EQ('\0', decoded.shm_name[SHM_MAX_NAME_BUFF_LEN - 1]);
+ EXPECT_EQ(static_cast<size_t>(SHM_MAX_NAME_BUFF_LEN - 1),
+ strnlen(decoded.shm_name, SHM_MAX_NAME_BUFF_LEN));
+ EXPECT_EQ(0, memcmp(msg.shm_name, decoded.shm_name,
+ SHM_MAX_NAME_BUFF_LEN - 1));
}
TEST_F(HelloMessageTest, toString_contains_fields) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
