Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix:(encoder) insufficient buffer size check for OP_i32 #269

Merged
merged 1 commit into from Jul 28, 2022

Conversation

AsterDY
Copy link
Collaborator

@AsterDY AsterDY commented Jul 28, 2022

  • since Go runtime always allocates memory of JIT stack _Stack right after that of output buffer buf:
    image

  • _OP_i32 has a boundary check of size 11, but in native-C code, when the integer is bigger than 99999999, the program will use vmovdqu %xmm0, (%rdi) instruction to write a 16-byte chars into buf and cross the bound of it
    image

  • once buffer has no space more than 16B, out-of-range memory writing can cause the corruption of _Stack, which finally causes abnormal behaviors of the program
    image

Here is reproducible codes:

func TestEncoderMemoryCorruption(t *testing.T) {
    var m = map[string]interface{}{
        "1": map[string]interface{} {
            `"`+strings.Repeat("a", _MaxBuffer - 38)+`"`: "b",
            "1": map[string]int32{
                "b": 1658219785,
            },
        },
    }
    out, err := Encode(m, SortMapKeys)
    if err != nil {
        t.Fatal(err)
    }
    println(len(out))
    if err := json.Unmarshal(out, &m); err != nil {
        t.Fatal(err)
    }
}

-------output----------
--- FAIL: TestEncoderMemoryCorruption (0.02s)
    /Users/admin/Desktop/kitex/sonic3/encoder/assembler_test.go:50: invalid character '\x00' in string literal
FAIL

@AsterDY AsterDY merged commit 8b51e75 into main Jul 28, 2022
@AsterDY AsterDY deleted the fix/encoder_panic branch July 28, 2022 09:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants