Commit Graph

5 Commits

Author SHA1 Message Date
Craig Tiller 6def7103bf Merge github.com:grpc/grpc into lfe3 2017-11-10 15:43:47 -08:00
Craig Tiller 4ac2b8e585 Enable clang-tidy as a sanity check, fix up all known failures 2017-11-10 14:14:17 -08:00
yang-g 272eebbbcd Only allocate what we need in the last slice for proto serialization 2017-11-09 09:54:54 -08:00
Jan Tattermusch 7897ae9308 auto-fix most of licenses 2017-06-08 11:22:41 +02:00
Harvey Tuch 5f3cfe960f Fix read from uninitialized memory bug in GrpcBufferWriter.
This commit fixes an issue in which the following sequence of operations
leads to use of uninitialized memory:

1. Caller invokes GrpcBufferWriter::Next(), and then makes use of 8191
   bytes in the returned buffer (which is 8192 bytes in size).

2. Caller then returns the unused single byte via
   GrpcBufferWriter::BackUp(). This method invokes
   g_core_codegen_interface->grpc_slice_split_tail(), which causes
   backup_slice_ to be a grpc_slice with one byte.

3. At the next invocation of GrpcBufferWriter::Next(), a reference to
   the single byte grpc_slice is returned to the caller.

The problem here is that the returned reference is to the inlined buffer
in the grpc_slice, which is resident in slice_, not the location of the
buffer inside slice_buffer_ after
g_core_codegen_interface->grpc_slice_buffer_add() in
GrpcBufferWriter::Next(). As a result, any data the caller writes to the
returned void* data is lost.

The solution is to avoid inlined backup slices.
2017-02-07 15:45:44 -05:00