Copilot commented on code in PR #13637:
URL: https://github.com/apache/trafficserver/pull/13637#discussion_r3933542609
##########
src/iocore/cache/CacheVC.cc:
##########
@@ -318,31 +318,51 @@ CacheVC::dead(int /* event ATS_UNUSED */, Event * /*e
ATS_UNUSED */)
return EVENT_DONE;
}
-static void
-unmarshal_helper(Doc *doc, Ptr<IOBufferData> &buf, int &okay)
+bool
+CacheVC::unmarshal_http_info(Doc *doc, Ptr<IOBufferData> &buf)
{
using UnmarshalFunc = int(char *buf, int len, RefCountObj
*block_ref);
UnmarshalFunc *unmarshal_func = &HTTPInfo::unmarshal;
ts::VersionNumber version(doc->v_major, doc->v_minor);
- // introduced by https://github.com/apache/trafficserver/pull/4874, this is
used to distinguish the doc version
- // before and after #4847
- if (version < CACHE_DB_VERSION) {
+ if (version < CACHE_DB_VERSION_HTTPINFO_V24_2) {
unmarshal_func = &HTTPInfo::unmarshal_v24_1;
}
+ // Objects written by an older version can carry stale well known string
indices and
+ // presence bits. Repair them only on the MARSHALED to ALIVE transition,
since an already
+ // ALIVE block may be shared with other readers. All alts of a doc
transition together, so
+ // the first one answers for the whole header block.
+ bool const needs_wks_fixup = version < CACHE_DB_VERSION && doc->hlen >=
sizeof(HTTPCacheAlt) &&
+ reinterpret_cast<HTTPCacheAlt
*>(doc->hdr())->m_magic == CacheAltMagic::MARSHALED;
+
char *tmp = doc->hdr();
int len = doc->hlen;
while (len > 0) {
Review Comment:
`doc->hlen` is a `uint32_t` but is narrowed into an `int` (`int len =
doc->hlen;`). If a corrupted (or otherwise malformed) object reports a large
`hlen` (> INT32_MAX), this can overflow to a negative value and cause the loop
to be skipped and the function to incorrectly return `true` without
unmarshalling, leaving a still-marshalled block to be consumed later. Add an
explicit upper-bound check and cast.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
