mirrors
/
redis
mirror of https://mirror.osredm.com/root/redis.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Avoid false positive out-of-bounds in writeForgottenNodePingExt (#11053) 

In clusterMsgPingExtForgottenNode, sizeof(name) is CLUSTER_NAMELEN,
and sizeof(clusterMsgPingExtForgottenNode) is > CLUSTER_NAMELEN.
Doing a (name + sizeof(clusterMsgPingExtForgottenNode)) sanitizer
generates an out-of-bounds error which is a false positive in here
This commit is contained in:
Binbin 2022-07-29 06:14:18 +08:00 committed by GitHub
parent e7144693e2
commit 90f35cea81
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/cluster.c
View File

@ -2035,7 +2035,7 @@ int writeHostnamePingExt(clusterMsgPingExt **cursor) {
(*cursor)->type = htons(CLUSTERMSG_EXT_TYPE_HOSTNAME); (*cursor)->type = htons(CLUSTERMSG_EXT_TYPE_HOSTNAME);
(*cursor)->length = htonl(extension_size); (*cursor)->length = htonl(extension_size);
/* Make sure the string is NULL terminated by adding 1 */ /* Make sure the string is NULL terminated by adding 1 */
*cursor = (clusterMsgPingExt *) (ext->hostname + EIGHT_BYTE_ALIGN(sdslen(myself->hostname) + 1)); *cursor = (clusterMsgPingExt *) ((intptr_t)ext + EIGHT_BYTE_ALIGN(sdslen(myself->hostname) + 1));
return extension_size; return extension_size;
} }
@ -2050,7 +2050,7 @@ int writeForgottenNodePingExt(clusterMsgPingExt **cursor, sds name, uint64_t ttl
uint32_t extension_size = sizeof(clusterMsgPingExt) + sizeof(clusterMsgPingExtForgottenNode); uint32_t extension_size = sizeof(clusterMsgPingExt) + sizeof(clusterMsgPingExtForgottenNode);
(*cursor)->type = htons(CLUSTERMSG_EXT_TYPE_FORGOTTEN_NODE); (*cursor)->type = htons(CLUSTERMSG_EXT_TYPE_FORGOTTEN_NODE);
(*cursor)->length = htonl(extension_size); (*cursor)->length = htonl(extension_size);
*cursor = (clusterMsgPingExt *) (ext->name + sizeof(clusterMsgPingExtForgottenNode)); *cursor = (clusterMsgPingExt *) (ext + 1);
return extension_size; return extension_size;
} }