grpc/proto_utils_test at 295df6da9aa8f6a51cd050ddf92f047d9179d9f2 - grpc

The C based gRPC (C++, Python, Ruby, Objective-C, PHP, C#) https://grpc.io/

Tag: Branch: Tree: 295df6da9a

Harvey Tuch 5f3cfe960f Fix read from uninitialized memory bug in GrpcBufferWriter. This commit fixes an issue in which the following sequence of operations leads to use of uninitialized memory: 1. Caller invokes GrpcBufferWriter::Next(), and then makes use of 8191 bytes in the returned buffer (which is 8192 bytes in size). 2. Caller then returns the unused single byte via GrpcBufferWriter::BackUp(). This method invokes g_core_codegen_interface->grpc_slice_split_tail(), which causes backup_slice_ to be a grpc_slice with one byte. 3. At the next invocation of GrpcBufferWriter::Next(), a reference to the single byte grpc_slice is returned to the caller. The problem here is that the returned reference is to the inlined buffer in the grpc_slice, which is resident in slice_, not the location of the buffer inside slice_buffer_ after g_core_codegen_interface->grpc_slice_buffer_add() in GrpcBufferWriter::Next(). As a result, any data the caller writes to the returned void* data is lost. The solution is to avoid inlined backup slices.	8 years ago
..
proto_utils_test.vcxproj	Fix read from uninitialized memory bug in GrpcBufferWriter.	8 years ago
proto_utils_test.vcxproj.filters	Fix read from uninitialized memory bug in GrpcBufferWriter.	8 years ago

Harvey Tuch 5f3cfe960f Fix read from uninitialized memory bug in GrpcBufferWriter.

This commit fixes an issue in which the following sequence of operations
leads to use of uninitialized memory:

1. Caller invokes GrpcBufferWriter::Next(), and then makes use of 8191
   bytes in the returned buffer (which is 8192 bytes in size).

2. Caller then returns the unused single byte via
   GrpcBufferWriter::BackUp(). This method invokes
   g_core_codegen_interface->grpc_slice_split_tail(), which causes
   backup_slice_ to be a grpc_slice with one byte.

3. At the next invocation of GrpcBufferWriter::Next(), a reference to
   the single byte grpc_slice is returned to the caller.

The problem here is that the returned reference is to the inlined buffer
in the grpc_slice, which is resident in slice_, not the location of the
buffer inside slice_buffer_ after
g_core_codegen_interface->grpc_slice_buffer_add() in
GrpcBufferWriter::Next(). As a result, any data the caller writes to the
returned void* data is lost.

The solution is to avoid inlined backup slices.

8 years ago

proto_utils_test.vcxproj

Fix read from uninitialized memory bug in GrpcBufferWriter.

8 years ago

proto_utils_test.vcxproj.filters

Fix read from uninitialized memory bug in GrpcBufferWriter.

8 years ago