You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "ASF subversion and git services (JIRA)" <ji...@apache.org> on 2013/05/25 08:05:21 UTC
[jira] [Commented] (TS-1913) Fix resolve_logfield_string()
[ https://issues.apache.org/jira/browse/TS-1913?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13666985#comment-13666985 ]
ASF subversion and git services commented on TS-1913:
-----------------------------------------------------
Commit a729aa63fcc7e7b5dcb8a19427067a8a20d4ed74 in branch refs/heads/master from Zhao Yongming <mi...@gmail.com>
[ https://git-wip-us.apache.org/repos/asf?p=trafficserver.git;h=a729aa6 ]
TS-1913: Fix resolve_logfield_string()
When bytes_resolved is 0, we should free result directly,
or it will return the not-null result to the caller with
the strlen(result) is 0, which will lead to ATS crash.
Signed-off-by: Yunkai Zhang <qi...@taobao.com>
Signed-off-by: Zhao Yongming <mi...@gmail.com>
> Fix resolve_logfield_string()
> -----------------------------
>
> Key: TS-1913
> URL: https://issues.apache.org/jira/browse/TS-1913
> Project: Traffic Server
> Issue Type: Bug
> Components: Core
> Reporter: Yunkai Zhang
> Attachments: 0001-Fix-resolve_logfield_string.patch
>
>
> When ATS receives a malicious request which URL is too long to hold by
> internal_msg_buffer, the internal_msg_buffer_size might be set to 0.
> As a result, the appended memory which allocated by ats_malloc() would
> be mistaken for the memory from ink_freelist, and would be free to
> ink_freelist finally.
> As this memory is larger than the one in ink_freelist, and all memory in
> the origin ink_freelist would not be reclaimed, so it wouldn't cause
> segment-fault, that is why we didn't notice it in the past.
> But after we use reclaimabe-freelist, this bug would cause segment-fault
> when use it to get inner meta-data or free it back to OS by unmmap().
> ===
> Now, we found the root cause which would lead to internal_msg_buffer_size to 0
> while internal_msg_buffer is NOT NULL.
> That is resolve_logfiled_string() function. Let's fix it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira