Repository navigation
Conversation
Client::Impl::ReceiveProfileInfo read the applied_limit and calculated_rows_before_limit wire bytes directly into bool members. A byte other than 0 or 1 left a bool with an invalid value, and loading it is undefined behaviour (UBSan reports it in OnProfile callbacks). Read each flag into a uint8_t and store whether it is non-zero; the obsolete has_nested byte in ReceiveException gets the same treatment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Client::Impl::ReceiveProfileInforeads theapplied_limitandcalculated_rows_before_limitwire bytes directly intoboolmembers. A byte other than 0 or 1 leaves a bool holding an invalid value, and loading it is undefined behaviour. UBSan reports "load of value 5, which is not a valid value for type 'bool'" inOnProfilecallbacks, and an optimized build can misbehave.Fix: read each flag into a
uint8_tand store whether it is non-zero. The obsoletehas_nestedbyte inReceiveExceptiongets the same treatment. No other wire read lands directly in abool.Reproducer: a ProfileInfo packet whose
applied_limitbyte is0x05.Test:
ClientProtocol.ProfileInfoFlagsAcceptAnyNonZeroBytesends bytes 5 and 255. It fails on master and passes here.