konevsa/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: protocol_buffer: Wrong maximum shifting.

Browse Source 
This patch fixes a bad stop condition when decoding a protocol buffer variable integer
whose maximum lenghts are 10, shifting a uint64_t value by more than 63.

Thank you to Ilya for having reported this issue.

Must be backported to 2.1 and 2.0.
This commit is contained in:
Frdric Lcaille 2020-04-02 14:24:31 +02:00 committed by Willy Tarreau
parent 5dfc5d5cd0
commit 876ed55d9b
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/proto/protocol_buffers.h
View File

@ -158,7 +158,7 @@ protobuf_varint(uint64_t *val, unsigned char *pos, size_t len)
shift += 7;
/* The maximum length in bytes of a 64-bit encoded value is 10. */
if (shift > 70)
if (shift > 63)
return 0;
}
@ -194,7 +194,7 @@ protobuf_decode_varint(uint64_t *val, unsigned char **pos, size_t *len)
shift += 7;
/* The maximum length in bytes of a 64-bit encoded value is 10. */
if (shift > 70)
if (shift > 63)
return 0;
}
@ -227,7 +227,7 @@ protobuf_skip_varint(unsigned char **pos, size_t *len, size_t vlen)
shift += 7;
/* The maximum length in bytes of a 64-bit encoded value is 10. */
if (shift > 70)
if (shift > 63)
return 0;
}
@ -263,7 +263,7 @@ protobuf_varint_getlen(unsigned char *pos, size_t len)
shift += 7;
/* The maximum length in bytes of a 64-bit encoded value is 10. */
if (shift > 70)
if (shift > 63)
return -1;
}