envoyproxy/envoy

[redis_proxy] potential out of memory/ with untrusted buffer when onData()

Open

#12,689 创建于 2020年8月17日

在 GitHub 查看
 (1 评论) (0 反应) (0 负责人)C++ (5,373 fork)batch import
area/redishelp wanted

仓库指标

Star
 (27,997 star)
PR 合并指标
 (平均合并 8天) (30 天内合并 378 个 PR)

描述

Since documentation of redis_proxy shows it is only accepts trusted data now, I think this is not a security issue, so I post it here.

In the decoder of redis_proxy filter, it reads an integer from the buffer and constructs a vector with size equal to it(pending_integer_.integer_). https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/common/redis/codec_impl.cc#L442

Untrusted buffer containing a very large integer here(as the size of the vector) may lead to out of memory or uncaught length_error exception.

We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.

The issue and test case can be found here: https://oss-fuzz.com/testcase-detail/5663259240431616

贡献者指南