Ashwani Raina has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24427
Change subject: [subprocess] Fix buffer over-read/overflow in message discard ...................................................................... [subprocess] Fix buffer over-read/overflow in message discard SubprocessProtocol::DoReadAndDiscard() clears an oversized message off the communication channel using a fixed 4K stack buffer, but bounded each read() with std::max<ssize_t>(rem, sizeof(buf)) instead of std::min(). Since this returns the greater of the two, the read length is never held to the buffer size. This causes two issues: * Stack buffer overflow: when the discarded payload is larger than 4K (say, 8K message), a single read() is asked to copy up to 'rem' bytes into the 4K buffer, smashing the stack. * Valid message subsumption: when the oversized payload is smaller than 4K, the read still pulls up to 4K, over-reading into and consuming the following well-formed message. The next ReceiveMessage() then loses that message, breaking the "discard to re-sync the channel" guarantee. The bug has existed since DoReadAndDiscard() was introduced in KUDU-3450. The patch fixes it by limiting each read to std::min(rem, sizeof(buf)), matching the Java implementation in doReadAndDiscard. Add two unit tests covering both scenarios: a deterministic over-read and an oversized-payload overflow test. Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c --- M src/kudu/subprocess/subprocess_protocol.cc M src/kudu/subprocess/subprocess_server-test.cc 2 files changed, 104 insertions(+), 1 deletion(-) git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/27/24427/1 -- To view, visit http://gerrit.cloudera.org:8080/24427 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c Gerrit-Change-Number: 24427 Gerrit-PatchSet: 1 Gerrit-Owner: Ashwani Raina <[email protected]>
