Commit Graph

22 Commits

Author SHA1 Message Date
Harvey Tuch 5f3cfe960f Fix read from uninitialized memory bug in GrpcBufferWriter.
This commit fixes an issue in which the following sequence of operations
leads to use of uninitialized memory:

1. Caller invokes GrpcBufferWriter::Next(), and then makes use of 8191
   bytes in the returned buffer (which is 8192 bytes in size).

2. Caller then returns the unused single byte via
   GrpcBufferWriter::BackUp(). This method invokes
   g_core_codegen_interface->grpc_slice_split_tail(), which causes
   backup_slice_ to be a grpc_slice with one byte.

3. At the next invocation of GrpcBufferWriter::Next(), a reference to
   the single byte grpc_slice is returned to the caller.

The problem here is that the returned reference is to the inlined buffer
in the grpc_slice, which is resident in slice_, not the location of the
buffer inside slice_buffer_ after
g_core_codegen_interface->grpc_slice_buffer_add() in
GrpcBufferWriter::Next(). As a result, any data the caller writes to the
returned void* data is lost.

The solution is to avoid inlined backup slices.
2017-02-07 15:45:44 -05:00
Craig Tiller 1d77059e4b Fix integer overflow 2017-01-19 11:44:42 -08:00
Craig Tiller 62f28bfcf0 Remove double-checking of max-message-size in C++ layers 2017-01-19 10:05:13 -08:00
Craig Tiller 32df467f11 Merge github.com:grpc/grpc into grpc_slice 2016-11-04 08:21:56 -07:00
Vijay Pai c0b2acb1a0 Use C++11 final and override 2016-11-01 16:31:56 -07:00
Craig Tiller 618e67d655 s/GPR_SLICE/GRPC_SLICE/g 2016-10-26 21:08:10 -07:00
Craig Tiller d41a4a720f s/gpr_slice/grpc_slice, and move around tests, impls 2016-10-26 16:16:06 -07:00
Mark D. Roth abf03aed93 Merge remote-tracking branch 'upstream/master' into max_send_size_filter 2016-09-16 07:35:37 -07:00
Mark D. Roth 6980362c4e Allow setting max send message size via C++ ServerBuilder API. 2016-09-06 08:15:36 -07:00
David Garcia Quintas c79b0650d2 removed codegen/log.h 2016-07-27 21:11:58 -07:00
David Garcia Quintas 3b31fdf77b removed codegen/byte_buffer.h 2016-07-27 18:17:12 -07:00
David Garcia Quintas 6721d4f0f1 Return success status of grpc_byte_buffer_reader 2016-06-30 17:30:08 -07:00
David Garcia Quintas 0fde7131aa Fixed usage of anon namespace inside .h 2016-05-13 15:13:51 -07:00
David Garcia Quintas 1b2db6333d Moved protos out of core_codegen interface 2016-04-27 15:09:11 -07:00
Craig Tiller 6169d5f7b0 Update copyrights 2016-03-31 07:46:18 -07:00
David Garcia Quintas b942640497 clang-format 2016-03-08 16:25:11 -08:00
David Garcia Quintas 6848c4e145 wip. prior to cq refactoring 2016-03-07 17:10:57 -08:00
David Garcia Quintas 7f7181ffc5 fix comments 2016-03-02 20:42:16 -08:00
David Garcia Quintas c4f4f7ede9 clang-format 2016-03-02 20:37:24 -08:00
David Garcia Quintas f588aeb1e2 introduced workaround for proto_utils 2016-03-02 20:33:28 -08:00
David Garcia Quintas 5a9462339d copyrights 2016-01-27 19:22:14 -08:00
David Garcia Quintas 6a48405ed0 pre sync_stream.cc creation. Does not compile 2016-01-25 19:12:37 -08:00