brbzull0 opened a new pull request, #13633:
URL: https://github.com/apache/trafficserver/pull/13633
`BUILD_TABLE_INFO` sizes its argument arrays at `BUILD_TABLE_MAX_ARGS`,
which is
2048 (`include/proxy/http/remap/RemapConfig.h:31,62-63`):
```c
char *paramv[BUILD_TABLE_MAX_ARGS];
char *argv[BUILD_TABLE_MAX_ARGS];
```
`remap_load_plugin()` declared its own locals at half that:
```c
const char *new_argv[1024];
char *pargv[1024];
```
so a `remap.config` line carrying more than 1024 arguments overflowed them.
In a
build with `ink_assert` enabled the existing assertion at
`RemapConfig.cc:912` catches it and aborts; without it the writes simply run
off
the end of two stack arrays.
Two further bounds issues in the same path:
- The `jump_to_argc` copy loop was `while (argv[i + jump_to_argc])`, i.e. it
walked until it found a null entry rather than stopping at `argc`.
- `remap_parse_config_bti()` appended to `bti->argv` / `bti->paramv` inside
the
tokenizer loop but only compared against `BUILD_TABLE_MAX_ARGS` after the
loop
had finished, so `bti->argc` could pass 2048 before anything checked.
### Change
- Size `new_argv` and `pargv` from `BUILD_TABLE_MAX_ARGS + 1`, so they can
hold
the full limit plus the nullptr sentinel the copy loop reserves.
- Bound the copy loop by `argc` and by `countof(new_argv) - 1`.
- Reject an over-long line while tokenizing, with the file and line number in
the error, instead of after the fact.
### Test
Adds `tests/gold_tests/remap/remap_plugin_argument_limits.test.py`, with a
near-limit rule that must load and serve, and an over-limit rule that must be
rejected. There is no existing test in `tests/gold_tests/remap/` covering the
argument count, and no collision with the 32 entries already there.
Confirmed it is a regression test: against unpatched `RemapConfig.cc` it
fails
with
```
Fatal: RemapConfig.cc:912: failed assertion
`static_cast<unsigned>(argc) < countof(new_argv)` : 3
```
so `traffic_server` aborts while parsing `remap.config`. With the change the
test passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
