rlm_ftp: fix write and read, make DISCARD sticky #5668
+38
−13
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Make DISCARD sticky. If state is DISCARD, drop subsequent chunks early. When switching to DISCARD, free buffer and reset alloc and used to 0. Fix 1 byte OOB write caused by talloc_bstr_realloc semantics on NULL. Allocate space for data plus the trailing NUL. For non NULL buffers request needed - 1 since bstr adds the NUL. For NULL buffers request full needed since bstr allocates exactly inlen bytes (no + 1). Prevent uninitialized data exposure after DISCARD by clearing stale used when buffer is NULL before writing. Always NUL terminate at buffer[used]. This removes the truncated tail return, prevents reading uninitialized bytes, and eliminates the off by one write on first allocation. This bug was found with ZeroPath. Signed-off-by: Joshua Rogers <[email protected]>
Contributor
Author
|
By the way, it is kind of surprising that |
Signed-off-by: Joshua Rogers <[email protected]>
Member
Yeah, that seems odd. I'll take a look. |
Member
|
Alan correct the behaviour of talloc_bstr_realloc, can you rework this PR to account for that. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Make DISCARD sticky. If state is DISCARD, drop subsequent chunks early.
When switching to DISCARD, free buffer and reset alloc and used to 0.
Fix 1 byte OOB write caused by talloc_bstr_realloc semantics on NULL. Allocate space for data plus the trailing NUL. For non NULL buffers request needed - 1 since bstr adds the NUL. For NULL buffers request full needed since bstr allocates exactly inlen bytes (no + 1).
Prevent uninitialized data exposure after DISCARD by clearing stale used when buffer is NULL before writing.
Always NUL terminate at buffer[used].
This removes the truncated tail return, prevents reading uninitialized bytes, and eliminates the off by one write on first allocation.
This bug was found with ZeroPath.