annotate src/core/ngx_murmurhash.c @ 7674:7731c710796f

Memcached: protect from too long responses. If a memcached response was followed by a correct trailer, and then the NUL character followed by some extra data - this was accepted by the trailer checking code. This in turn resulted in ctx->rest underflow and caused negative size buffer on the next reading from the upstream, followed by the "negative size buf in writer" alert. Fix is to always check for too long responses, so a correct trailer cannot be followed by extra data.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 06 Jul 2020 18:36:17 +0300
parents f38647c651a8
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
3891
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2 /*
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3 * Copyright (C) Austin Appleby
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
4 */
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
5
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
6
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
7 #include <ngx_config.h>
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 #include <ngx_core.h>
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
10
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
11 uint32_t
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
12 ngx_murmur_hash2(u_char *data, size_t len)
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
13 {
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
14 uint32_t h, k;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
15
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
16 h = 0 ^ len;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
17
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
18 while (len >= 4) {
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
19 k = data[0];
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
20 k |= data[1] << 8;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
21 k |= data[2] << 16;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
22 k |= data[3] << 24;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
23
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
24 k *= 0x5bd1e995;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
25 k ^= k >> 24;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
26 k *= 0x5bd1e995;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
27
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
28 h *= 0x5bd1e995;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
29 h ^= k;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
30
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
31 data += 4;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
32 len -= 4;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
33 }
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
34
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
35 switch (len) {
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
36 case 3:
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
37 h ^= data[2] << 16;
6994
f38647c651a8 Added missing "fall through" comments (ticket #1259).
Maxim Dounin <mdounin@mdounin.ru>
parents: 3891
diff changeset
38 /* fall through */
3891
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
39 case 2:
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
40 h ^= data[1] << 8;
6994
f38647c651a8 Added missing "fall through" comments (ticket #1259).
Maxim Dounin <mdounin@mdounin.ru>
parents: 3891
diff changeset
41 /* fall through */
3891
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
42 case 1:
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
43 h ^= data[0];
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
44 h *= 0x5bd1e995;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
45 }
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
46
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
47 h ^= h >> 13;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
48 h *= 0x5bd1e995;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
49 h ^= h >> 15;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
50
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
51 return h;
203eb026ec07 ngx_murmur_hash2()
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
52 }