envoyproxy/envoy
GitHub で見る[redis_proxy] potential out of memory/ with untrusted buffer when onData()
Open
#12,689 opened on 2020年8月17日
area/redishelp wanted
Repository metrics
- Stars
- (27,997 stars)
- PR merge metrics
- (平均マージ 8d) (30d で 378 merged PRs)
説明
Since documentation of redis_proxy shows it is only accepts trusted data now, I think this is not a security issue, so I post it here.
In the decoder of redis_proxy filter, it reads an integer from the buffer and constructs a vector with size equal to it(pending_integer_.integer_). https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/common/redis/codec_impl.cc#L442
Untrusted buffer containing a very large integer here(as the size of the vector) may lead to out of memory or uncaught length_error exception.
We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.
The issue and test case can be found here: https://oss-fuzz.com/testcase-detail/5663259240431616