[jira] [Commented] (IMPALA-13150) Possible buffer overflow in StringVal::CopyFrom()

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/IMPALA-13150?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17855719#comment-17855719 ] 

ASF subversion and git services commented on IMPALA-13150:
----------------------------------------------------------

Commit 5d7ca0712af493eca6704a3fdfcfaf16bde46ed0 in impala's branch refs/heads/master from Daniel Becker
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=5d7ca0712 ]

IMPALA-13150: Possible buffer overflow in StringVal::CopyFrom()

In StringVal::CopyFrom(), we take the 'len' parameter as a size_t, which
is usually a 64-bit unsigned integer. We pass it to the constructor of
StringVal, which takes it as an int, which is usually a 32-bit signed
integer. The constructor then allocates memory for the length using the
int value, but afterwards in CopyFrom(), we copy the buffer with the
size_t length. If size_t is indeed 64 bits and int is 32 bits, and the
value is truncated, we may copy more bytes that what we have allocated
for the destination.

Note that in the constructor of StringVal it is checked whether the
length is greater than 1GB, but if the value is truncated because of the
type conversion, the check doesn't necessarily catch it as the truncated
value may be small.

This change fixes the problem by doing the length check with 64 bit
integers in StringVal::CopyFrom().

Testing:
 - added unit tests for StringVal::CopyFrom() in udf-test.cc.

Change-Id: I6a1d03d65ec4339a0f33e69ff29abdd8cc3e3067
Reviewed-on: http://gerrit.cloudera.org:8080/21501
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>


> Possible buffer overflow in StringVal::CopyFrom()
> -------------------------------------------------
>
>                 Key: IMPALA-13150
>                 URL: https://issues.apache.org/jira/browse/IMPALA-13150
>             Project: IMPALA
>          Issue Type: Bug
>          Components: Backend
>            Reporter: Daniel Becker
>            Assignee: Daniel Becker
>            Priority: Major
>
> In {{{}StringVal::CopyFrom(){}}}, we take the 'len' parameter as a {{{}size_t{}}}, which is usually a 64-bit unsigned integer. We pass it to the constructor of {{{}StringVal{}}}, which takes it as an {{{}int{}}}, which is usually a 32-bit signed integer. The constructor then allocates memory for the length using the {{int}} value, but back in {{{}CopyFrom(){}}}, we copy the buffer with the {{size_t}} length. If {{size_t}} is indeed 64 bits and {{int}} is 32 bits, and the value is truncated, we may copy more bytes that what we have allocated the destination for. See https://github.com/apache/impala/blob/ce8078204e5995277f79e226e26fe8b9eaca408b/be/src/udf/udf.cc#L546



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org