envoyproxy / envoyproxy/envoy

[redis_proxy] potential out of memory/ with untrusted buffer when onData()

Open
#12,689 1 comment 0 reactions 0 assignees View on GitHub
area/redis help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

#### Since documentation of redis_proxy shows it is only accepts trusted data now, I think this is not a security issue, so I post it here.

In the decoder of redis_proxy filter, it reads an integer from the buffer and constructs a vector with size equal to it(pending_integer_.integer_).
https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/common/redis/codec_impl.cc#L442

Untrusted buffer containing a very large integer here(as the size of the vector) may lead to out of memory or uncaught length_error exception.

We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.

The issue and test case can be found here:
https://oss-fuzz.com/testcase-detail/5663259240431616

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.