envoyproxy/envoy
在 GitHub 查看[redis_proxy] potential out of memory/ with untrusted buffer when onData()
Open
#12,689 创建于 2020年8月17日
area/redishelp wanted
仓库指标
- Star
- (27,997 star)
- PR 合并指标
- (平均合并 8天) (30 天内合并 378 个 PR)
描述
Since documentation of redis_proxy shows it is only accepts trusted data now, I think this is not a security issue, so I post it here.
In the decoder of redis_proxy filter, it reads an integer from the buffer and constructs a vector with size equal to it(pending_integer_.integer_). https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/common/redis/codec_impl.cc#L442
Untrusted buffer containing a very large integer here(as the size of the vector) may lead to out of memory or uncaught length_error exception.
We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.
The issue and test case can be found here: https://oss-fuzz.com/testcase-detail/5663259240431616