mirror of
https://github.com/MariaDB/server.git
synced 2026-10-23 18:49:29 +03:00
9660806dc9
parse_v2_header() required only 25 (TCPv4) / 49 (TCPv6) bytes, but then reads the source port at hdr[25] / hdr[49]. A truncated header could make it read uninitialized stack. Require the whole address block: 28 bytes for TCPv4 and 52 for TCPv6. Also, the declared header length was trusted without checking how many bytes vio_read() returned. Reject short reads. The spec requires the sender to send the header at once, and allows the receiver to drop the connection on a partial header, so a single vio_read() is enough. The v1 parser had the same problem on EOF: vio_read() returning 0 was taken for a byte read, so the uninitialized buffer was parsed. Require exactly one byte. Extend test_proxy_header_tcp with a header cut short before the port, and add test_proxy_header_short for a header shorter than it declares. Light refactoring, to avoid repetition: added connect_tcp() and init_v2_header(), which are now shared by several proxy header tests. Assisted-by: Claude:claude-sonnet-5-5