[redis_proxy] potential out of memory/ with untrusted buffer when onData()
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 437
Description
#### Since documentation of redis_proxy shows it is only accepts trusted data now, I think this is not a security issue, so I post it here.
In the decoder of redis_proxy filter, it reads an integer from the buffer and constructs a vector with size equal to it(pending_integer_.integer_).
https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/common/redis/codec_impl.cc#L442
Untrusted buffer containing a very large integer here(as the size of the vector) may lead to out of memory or uncaught length_error exception.
We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.
The issue and test case can be found here:
https://oss-fuzz.com/testcase-detail/5663259240431616
Contributor guide
Assessment
This issue has not been assessed yet.