Copilot commented on code in PR #13519:
URL: https://github.com/apache/trafficserver/pull/13519#discussion_r3738626207
##########
src/iocore/net/quic/QUICTypes.cc:
##########
@@ -723,17 +723,26 @@ QUICConnectionId::ZERO()
return QUICConnectionId(zero, 0);
}
-QUICConnectionId::QUICConnectionId()
-{
- this->randomize();
-}
-
QUICConnectionId::QUICConnectionId(const uint8_t *buf, uint8_t len) : _len(len)
{
ink_assert(len <= QUICConnectionId::MAX_LENGTH);
memcpy(this->_id, buf, std::min(static_cast<int>(len),
QUICConnectionId::MAX_LENGTH));
}
Review Comment:
`QUICConnectionId(const uint8_t *buf, uint8_t len)` only has a debug-only
`ink_assert(len <= MAX_LENGTH)` but still stores `_len = len`. In release
builds, if a caller ever passes `len > MAX_LENGTH`, `_len` becomes out of range
and methods like `hex()` will read past `_id`, causing OOB reads. It’s safer to
clamp `_len` to `MAX_LENGTH` (and keep the assert for debug) so the object
remains internally consistent even on bad input.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
