Skip to content

fix out-of-bounds read in repe zero-copy read_params - #2729

Open
uwezkhan wants to merge 1 commit into
stephenberry:mainfrom
uwezkhan:repe-span-body-bound
Open

fix out-of-bounds read in repe zero-copy read_params#2729
uwezkhan wants to merge 1 commit into
stephenberry:mainfrom
uwezkhan:repe-span-body-bound

Conversation

@uwezkhan

Copy link
Copy Markdown
Contributor

registry::call(std::span<const char>, std::string&) parses the request in place, so state.in.body views the caller's span with nothing guaranteed after it, yet the state_view overload of read_params reads that view with the registry's Opts, whose null_terminated is on by default. That is the mode in which the JSON reader drops its end checks and scans for a '\0' sentinel. Before: a 51 byte buffer holding a well formed message whose body is 1 gives an ASAN heap-buffer-overflow read of size 1, zero bytes past the allocation; after: the scan stops at the end of the span.

The message overload beside it is unaffected because its body is a std::string, which does supply that sentinel, so the view overload is where the buffer shape is known and where the bound belongs rather than in the callers that own the span. Reading the body as unterminated input trades the sentinel scan for per-byte end checks. It also moves one edge case: a whitespace-only body now reads as an empty value instead of a number failure, which is what glz::read already returns for the same bytes with null_terminated off.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant