natas_hw
/
grpc
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed Heap-buffer-overflow in parse_unix via clusterfuzz

This commit is contained in:
David Garcia Quintas 2017-02-22 14:32:56 -08:00
parent 25bbef639e
commit bcd5f12e4b
5 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/core/ext/client_channel/parse_address.c
View File

@ -49,9 +49,10 @@
int parse_unix(grpc_uri *uri, grpc_resolved_address *resolved_addr) {
struct sockaddr_un *un = (struct sockaddr_un *)resolved_addr->addr;
memset(un, 0, sizeof(*un));
un->sun_family = AF_UNIX;
strcpy(un->sun_path, uri->path);
strncpy(un->sun_path, uri->path, sizeof(un->sun_path) - 1 /* null term'd */);
resolved_addr->len = strlen(un->sun_path) + sizeof(un->sun_family) + 1;
return 1;

4
src/core/ext/transport/chttp2/client/insecure/channel_create.c
View File

@ -73,7 +73,9 @@ static grpc_channel *client_channel_factory_create_channel(
arg.type = GRPC_ARG_STRING;
arg.key = GRPC_ARG_SERVER_URI;
arg.value.string = grpc_resolver_factory_add_default_prefix_if_needed(target);
grpc_channel_args *new_args = grpc_channel_args_copy_and_add(args, &arg, 1);
const char *to_remove[] = {GRPC_ARG_SERVER_URI};
grpc_channel_args *new_args =
grpc_channel_args_copy_and_add_and_remove(args, to_remove, 1, &arg, 1);
gpr_free(arg.value.string);
grpc_channel *channel = grpc_channel_create(exec_ctx, target, new_args,
GRPC_CLIENT_CHANNEL, NULL);

4
src/core/ext/transport/chttp2/client/secure/secure_channel_create.c
View File

@ -182,7 +182,9 @@ static grpc_channel *client_channel_factory_create_channel(
arg.type = GRPC_ARG_STRING;
arg.key = GRPC_ARG_SERVER_URI;
arg.value.string = grpc_resolver_factory_add_default_prefix_if_needed(target);
grpc_channel_args *new_args = grpc_channel_args_copy_and_add(args, &arg, 1);
const char *to_remove[] = {GRPC_ARG_SERVER_URI};
grpc_channel_args *new_args =
grpc_channel_args_copy_and_add_and_remove(args, to_remove, 1, &arg, 1);
gpr_free(arg.value.string);
grpc_channel *channel = grpc_channel_create(exec_ctx, target, new_args,
GRPC_CLIENT_CHANNEL, NULL);

BIN
test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-5834320218423296 Normal file
View File

Binary file not shown.

22
tools/run_tests/generated/tests.json
View File

@ -79681,6 +79681,28 @@
],
"uses_polling": false
},
{
"args": [
"test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-5834320218423296"
],
"ci_platforms": [
"linux"
],
"cpu_cost": 0.1,
"exclude_configs": [
"tsan"
],
"exclude_iomgrs": [
"uv"
],
"flaky": false,
"language": "c",
"name": "api_fuzzer_one_entry",
"platforms": [
"linux"
],
"uses_polling": false
},
{
"args": [
"test/core/end2end/fuzzers/api_fuzzer_corpus/crash-0597bbdd657fa4ed14443994c9147a1a7bbc205f"