Commit Graph

3 Commits

Author SHA1 Message Date
Harvey Tuch 5f3cfe960f Fix read from uninitialized memory bug in GrpcBufferWriter.
This commit fixes an issue in which the following sequence of operations
leads to use of uninitialized memory:

1. Caller invokes GrpcBufferWriter::Next(), and then makes use of 8191
   bytes in the returned buffer (which is 8192 bytes in size).

2. Caller then returns the unused single byte via
   GrpcBufferWriter::BackUp(). This method invokes
   g_core_codegen_interface->grpc_slice_split_tail(), which causes
   backup_slice_ to be a grpc_slice with one byte.

3. At the next invocation of GrpcBufferWriter::Next(), a reference to
   the single byte grpc_slice is returned to the caller.

The problem here is that the returned reference is to the inlined buffer
in the grpc_slice, which is resident in slice_, not the location of the
buffer inside slice_buffer_ after
g_core_codegen_interface->grpc_slice_buffer_add() in
GrpcBufferWriter::Next(). As a result, any data the caller writes to the
returned void* data is lost.

The solution is to avoid inlined backup slices.
2017-02-07 15:45:44 -05:00
David Garcia Quintas 1399e466b0 removed codegen/time.h 2016-07-27 20:31:55 -07:00
David Garcia Quintas 3a43cc06a8 Added codegen_test_full
Which makes sure target that depend on both codegen and grpc build.
2016-04-08 16:59:51 -07:00