envoyproxy/envoy

[redis_proxy] potential out of memory/ with untrusted buffer when onData()

Open

#12,689 建立於 2020年8月17日

在 GitHub 查看
 (1 留言) (0 反應) (0 負責人)C++ (5,373 fork)batch import
area/redishelp wanted

倉庫指標

Star
 (27,997 star)
PR 合併指標
 (平均合併 8天) (30 天內合併 378 個 PR)

描述

Since documentation of redis_proxy shows it is only accepts trusted data now, I think this is not a security issue, so I post it here.

In the decoder of redis_proxy filter, it reads an integer from the buffer and constructs a vector with size equal to it(pending_integer_.integer_). https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/common/redis/codec_impl.cc#L442

Untrusted buffer containing a very large integer here(as the size of the vector) may lead to out of memory or uncaught length_error exception.

We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.

The issue and test case can be found here: https://oss-fuzz.com/testcase-detail/5663259240431616

貢獻者指南