Skip to content

memory corruption fixes in zone cut

Marek Vavrusa requested to merge marek/memory-corruption-fixes into master

Several operations were not safe to call on empty pack and would return invalid memory. If the pack would have reserved space, but would be empty (length = 0), it's head would be NULL but tail would be array address (pack->at + 0). This is mostly checked by caller, but it wasn't in several places (object deletion). The address election would then crash like this:

#0  pack_obj_len (it=0x2 <error: Cannot access memory at address 0x2>) at /cfsetup_build/knot-resolver/tmp/build/knot-resolver/lib/generic/pack.h:112
#1  eval_addr_set (score=<optimized out>, addr=0x7ffea96f7120, opts=0x56376fc7beb6, ctx=<optimized out>, ctx=<optimized out>, addr_set=<optimized out>, addr_set=<optimized out>) at lib/nsrep.c:98
#2  0x00007f38b0549e6e in kr_nsrep_elect_addr (qry=0x7ffea96f7060, qry@entry=0x56376fc7bea0, ctx=0xa) at lib/nsrep.c:374
#3  0x00007f38b054d2a4 in kr_resolve_produce (request=request@entry=0x56376ea0f370, dst=dst@entry=0x56376ea0f850, type=type@entry=0x7ffea96f725c, packet=<optimized out>) at lib/resolve.c:1430
#4  0x000056376c6ffdfb in qr_task_step (task=0x56376ea0f7f8, packet_source=0x7ffea96f7370, packet=0x56376e5409a0) at daemon/worker.c:1590

I think it's better to return invalid pointers in this case, instead of indeterminate pointers as it's at least analyzable.

Merge request reports