Alexey Serbin has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24428 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard ...................................................................... [subprocess] Fix buffer over-read/overflow in message discard SubprocessProtocol::DoReadAndDiscard() clears an oversized message off the communication channel using a fixed 4K stack buffer, but bounded each read() with std::max<ssize_t>(rem, sizeof(buf)) instead of std::min(). Since this returns the greater of the two, the read length is never held to the buffer size. This causes two issues: * Stack buffer overflow: when the discarded payload is larger than 4K (say, 8K message), a single read() is asked to copy up to 'rem' bytes into the 4K buffer, smashing the stack. * Valid message subsumption: when the oversized payload is smaller than 4K, the read still pulls up to 4K, over-reading into and consuming the following well-formed message. The next ReceiveMessage() then loses that message, breaking the "discard to re-sync the channel" guarantee. The bug has existed since DoReadAndDiscard() was introduced in KUDU-3450. The patch fixes it by limiting each read to std::min(rem, sizeof(buf)), matching the Java implementation in doReadAndDiscard. Add two unit tests covering both scenarios: a deterministic over-read and an oversized-payload overflow test. Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c Reviewed-on: http://gerrit.cloudera.org:8080/24427 Reviewed-by: Alexey Serbin <[email protected]> Tested-by: Alexey Serbin <[email protected]> (cherry picked from commit c968d85cc9d5ea18cbabf7464cb48bbec51a63a6) Reviewed-on: http://gerrit.cloudera.org:8080/24428 Reviewed-by: Abhishek Chennaka <[email protected]> --- M src/kudu/subprocess/subprocess_protocol.cc M src/kudu/subprocess/subprocess_server-test.cc 2 files changed, 104 insertions(+), 1 deletion(-) Approvals: Abhishek Chennaka: Looks good to me, approved Alexey Serbin: Verified -- To view, visit http://gerrit.cloudera.org:8080/24428 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: branch-1.18.x Gerrit-MessageType: merged Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c Gerrit-Change-Number: 24428 Gerrit-PatchSet: 2 Gerrit-Owner: Alexey Serbin <[email protected]> Gerrit-Reviewer: Abhishek Chennaka <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Ashwani Raina <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120)
