12583
82%
master: 87%

Ran 25 Jun 2018 02:11PM UTC

Jobs 1

Files 293

Run time 31s

Badge

Embed ▾

pending completion

Build # 12583

Build Type

push

travis-ci

Committed by

Gerold103

Commit Message

iproto: protect from false-correct size in msg header

Consider this packet:

    msgpack = require('msgpack')
    data = msgpack.encode(18400000000000000000)..'aaaaaaa'

Tarantool interprets 18400000000000000000 as size of a coming
iproto request, and tries with no any checks to allocate buffer
of such size. It calculates needed capacity like this:

    capacity = start_value;
    while (capacity < size)
        capacity *= 2;

Here it is possible that on i-th iteration 'capacity' < 'size',
but 'capacity * 2' overflows 64 bits and becomes < 'size' again,
so this loop never ends and occupies 100% CPU.

Strictly speaking overflow has undefined behavior. On the
original system it led to nullifying 'capacity'.

Such size is improbable as a real packet gabarits, but can appear
as a result of parsing of some invalid packet, first bytes of
which accidentally appears to be valid MessagePack uint. This is
how the bug emerged on the real system.

Lets restrict the maximal packet size to 2GB.

Closes #3464

Run Details

38252 of 46912 relevant lines covered (81.54%)

918899.31 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
3	12583.3 (TARGET=coverage)	25 Jun 2018 02:11PM UTC	293	81.54	Travis Job 12583.3

tarantool / tarantool / 12583
82%
master: 87%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 12583

tarantool / tarantool / 12583 82% master: 87%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 12583

tarantool / tarantool / 12583
82%
master: 87%

README BADGES
x