masaori335 commented on code in PR #13768:
URL: https://github.com/apache/trafficserver/pull/13768#discussion_r4204506476
##########
src/iocore/cache/CacheVC.cc:
##########
@@ -403,6 +403,15 @@ CacheVC::handleReadDone(int event, Event * /* e ATS_UNUSED
*/)
goto Ldone;
}
+ // Everything below trusts len and hlen, and STORE_COLLISION lets a doc
that is not ours get this far.
+ if (doc->magic == DOC_MAGIC &&
Review Comment:
Good catch. A doc that isn't ours now leaves handleReadDone as DOC_MAGIC
without reaching the RAM cache or unmarshal code, so the callers treat it as a
collision and keep probing as before. Only our own doc is marked DOC_CORRUPT.
Every handleReadDone caller compares the key before using len, so the foreign
doc's length is never trusted. A new test case checks that a foreign doc with a
bad length stops before unmarshal_http_info. Fixed in
[5be75ab](https://github.com/apache/trafficserver/pull/13768/commits/5be75ab63e94b3c717929b83fb05aa13d4dfd97e).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
