snappy: read frame length as 3 bytes to avoid OOB at boundary [Backport to 4.2]#11901
Conversation
The frame header is 4 bytes: 1 byte type + 3 bytes little-endian length. The previous code read a uint32_t at frame_buffer[1] which touches byte index 4, but the bounds check only ensures indices 0-3 are valid. When exactly 4 bytes remain, byte 4 is out of bounds. Read the 3-byte length field byte-by-byte instead. This also fixes a potential unaligned memory access on strict-alignment architectures. Signed-off-by: Tristan <tristan@talencesecurity.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c79c8bbbec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| frame_length = ((uint32_t)((unsigned char) frame_buffer[1])) | | ||
| ((uint32_t)((unsigned char) frame_buffer[2]) << 8) | | ||
| ((uint32_t)((unsigned char) frame_buffer[3]) << 16); |
There was a problem hiding this comment.
For malformed framed snappy input with fewer than 4 bytes remaining (for example an HTTP/Prometheus/OTel request body that starts with the stream-identifier byte but is only 1–3 bytes long, or has a 1–3 byte trailing frame), while (offset < in_len) still enters the loop and these byte loads read past the supplied buffer. The previous unaligned 32-bit load was narrowed, but the frame header still needs an in_len - offset >= 4 check before reading frame_buffer[1..3].
Useful? React with 👍 / 👎.
1 participant
BVackporting of #11855.
Enter
[N/A]in the box, if an item is not applicable to your change.Testing
Before we can approve your change; please submit the following in a comment:
If this is a change to packaging of containers or native binaries then please confirm it works for all targets.
ok-package-testlabel to test for all targets (requires maintainer to do).Documentation
Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.