dxbjavid opened a new pull request, #13835:
URL: https://github.com/apache/trafficserver/pull/13835
When an access log uses JSON escaping, unmarshal_str_json works out the
slice offset from the escaped length but then reads from the raw marshalled
value, which is only as long as the unescaped string. A client header value of
control characters logged with a slice modifier such as %<{X-Foo}cqh>[50:60]
therefore makes the read start tens of bytes past the end of the value, an
out-of-bounds heap read whose bytes end up in the log line. I've made it slice
against the raw length like the non-JSON unmarshal_str sibling already does,
and given escape_json a separate destination-capacity argument so the number of
source bytes it reads is no longer tied to the output buffer size (which also
removes a smaller over-read on the non-slice path). Confirmed under ASan and
added a regression case to test_LogAccess.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
