Mercurial > hg > nginx
annotate src/event/quic/ngx_event_quic_bpf_code.c @ 9322:d6f75dd66761 default tip
Mp4: added and updated sanity checks for "end" handling.
When handling incorrect data in ngx_http_mp4_crop_stsc_data(),
trak->end_chunk_samples might end up being arbitrary large, leading
to reading before the buffer in ngx_http_mp4_update_stsz_atom(). Fix
is to check that trak->end_chunk_samples corresponds to a memory within
the stsz atom data. For consistency, trak->start_chunk_samples
is checked similarly.
Similarly, trak->end_chunk might end up being smaller than trak->start_chunk,
leading to reading memory after the buffer in ngx_http_mp4_update_stco_atom()
and ngx_http_mp4_update_co64_atom(). Corresponding checks are updated
to explicitly test (trak->end_chunk - trak->start_chunk) instead of just
checking trak->end_chunk and assuming it is larger than trak->start_chunk.
This is generally in line with existing checks of
(trak->end_sample - trak->start_sample) in ngx_http_mp4_update_stsz_atom(),
where trak->end_sample might also become smaller than trak->start_sample
when handling incorrect data in ngx_http_mp4_crop_stts_data().
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Sun, 25 Aug 2024 06:35:40 +0300 |
parents | 6d1488b62dc5 |
children |
rev | line source |
---|---|
8676 | 1 /* AUTO-GENERATED, DO NOT EDIT. */ |
2 | |
3 #include <stddef.h> | |
4 #include <stdint.h> | |
5 | |
6 #include "ngx_bpf.h" | |
7 | |
8 | |
9 static ngx_bpf_reloc_t bpf_reloc_prog_ngx_quic_reuseport_helper[] = { | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
10 { "ngx_quic_sockmap", 55 }, |
8676 | 11 }; |
12 | |
13 static struct bpf_insn bpf_insn_prog_ngx_quic_reuseport_helper[] = { | |
14 /* opcode dst src offset imm */ | |
15 { 0x79, BPF_REG_4, BPF_REG_1, (int16_t) 0, 0x0 }, | |
16 { 0x79, BPF_REG_3, BPF_REG_1, (int16_t) 8, 0x0 }, | |
17 { 0xbf, BPF_REG_2, BPF_REG_4, (int16_t) 0, 0x0 }, | |
18 { 0x7, BPF_REG_2, BPF_REG_0, (int16_t) 0, 0x8 }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
19 { 0x2d, BPF_REG_2, BPF_REG_3, (int16_t) 54, 0x0 }, |
8676 | 20 { 0xbf, BPF_REG_5, BPF_REG_4, (int16_t) 0, 0x0 }, |
21 { 0x7, BPF_REG_5, BPF_REG_0, (int16_t) 0, 0x9 }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
22 { 0x2d, BPF_REG_5, BPF_REG_3, (int16_t) 51, 0x0 }, |
8676 | 23 { 0xb7, BPF_REG_5, BPF_REG_0, (int16_t) 0, 0x14 }, |
24 { 0xb7, BPF_REG_0, BPF_REG_0, (int16_t) 0, 0x9 }, | |
25 { 0x71, BPF_REG_6, BPF_REG_2, (int16_t) 0, 0x0 }, | |
26 { 0x67, BPF_REG_6, BPF_REG_0, (int16_t) 0, 0x38 }, | |
27 { 0xc7, BPF_REG_6, BPF_REG_0, (int16_t) 0, 0x38 }, | |
28 { 0x65, BPF_REG_6, BPF_REG_0, (int16_t) 10, 0xffffffff }, | |
29 { 0xbf, BPF_REG_2, BPF_REG_4, (int16_t) 0, 0x0 }, | |
30 { 0x7, BPF_REG_2, BPF_REG_0, (int16_t) 0, 0xd }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
31 { 0x2d, BPF_REG_2, BPF_REG_3, (int16_t) 42, 0x0 }, |
8676 | 32 { 0xbf, BPF_REG_5, BPF_REG_4, (int16_t) 0, 0x0 }, |
33 { 0x7, BPF_REG_5, BPF_REG_0, (int16_t) 0, 0xe }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
34 { 0x2d, BPF_REG_5, BPF_REG_3, (int16_t) 39, 0x0 }, |
8676 | 35 { 0xb7, BPF_REG_0, BPF_REG_0, (int16_t) 0, 0xe }, |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
36 { 0x71, BPF_REG_5, BPF_REG_2, (int16_t) 0, 0x0 }, |
8676 | 37 { 0xb7, BPF_REG_6, BPF_REG_0, (int16_t) 0, 0x8 }, |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
38 { 0x2d, BPF_REG_6, BPF_REG_5, (int16_t) 35, 0x0 }, |
8676 | 39 { 0xf, BPF_REG_5, BPF_REG_0, (int16_t) 0, 0x0 }, |
40 { 0xf, BPF_REG_4, BPF_REG_5, (int16_t) 0, 0x0 }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
41 { 0x2d, BPF_REG_4, BPF_REG_3, (int16_t) 32, 0x0 }, |
8676 | 42 { 0xbf, BPF_REG_4, BPF_REG_2, (int16_t) 0, 0x0 }, |
43 { 0x7, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x9 }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
44 { 0x2d, BPF_REG_4, BPF_REG_3, (int16_t) 29, 0x0 }, |
8676 | 45 { 0x71, BPF_REG_4, BPF_REG_2, (int16_t) 1, 0x0 }, |
46 { 0x67, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x38 }, | |
47 { 0x71, BPF_REG_3, BPF_REG_2, (int16_t) 2, 0x0 }, | |
48 { 0x67, BPF_REG_3, BPF_REG_0, (int16_t) 0, 0x30 }, | |
49 { 0x4f, BPF_REG_3, BPF_REG_4, (int16_t) 0, 0x0 }, | |
50 { 0x71, BPF_REG_4, BPF_REG_2, (int16_t) 3, 0x0 }, | |
51 { 0x67, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x28 }, | |
52 { 0x4f, BPF_REG_3, BPF_REG_4, (int16_t) 0, 0x0 }, | |
53 { 0x71, BPF_REG_4, BPF_REG_2, (int16_t) 4, 0x0 }, | |
54 { 0x67, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x20 }, | |
55 { 0x4f, BPF_REG_3, BPF_REG_4, (int16_t) 0, 0x0 }, | |
56 { 0x71, BPF_REG_4, BPF_REG_2, (int16_t) 5, 0x0 }, | |
8721
85e60c064728
QUIC: bpf code regenerated.
Vladimir Homutov <vl@nginx.com>
parents:
8676
diff
changeset
|
57 { 0x67, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x18 }, |
8676 | 58 { 0x4f, BPF_REG_3, BPF_REG_4, (int16_t) 0, 0x0 }, |
59 { 0x71, BPF_REG_4, BPF_REG_2, (int16_t) 6, 0x0 }, | |
60 { 0x67, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x10 }, | |
61 { 0x4f, BPF_REG_3, BPF_REG_4, (int16_t) 0, 0x0 }, | |
62 { 0x71, BPF_REG_4, BPF_REG_2, (int16_t) 7, 0x0 }, | |
63 { 0x67, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x8 }, | |
64 { 0x4f, BPF_REG_3, BPF_REG_4, (int16_t) 0, 0x0 }, | |
65 { 0x71, BPF_REG_2, BPF_REG_2, (int16_t) 8, 0x0 }, | |
66 { 0x4f, BPF_REG_3, BPF_REG_2, (int16_t) 0, 0x0 }, | |
67 { 0x7b, BPF_REG_10, BPF_REG_3, (int16_t) 65528, 0x0 }, | |
68 { 0xbf, BPF_REG_3, BPF_REG_10, (int16_t) 0, 0x0 }, | |
69 { 0x7, BPF_REG_3, BPF_REG_0, (int16_t) 0, 0xfffffff8 }, | |
70 { 0x18, BPF_REG_2, BPF_REG_0, (int16_t) 0, 0x0 }, | |
71 { 0x0, BPF_REG_0, BPF_REG_0, (int16_t) 0, 0x0 }, | |
72 { 0xb7, BPF_REG_4, BPF_REG_0, (int16_t) 0, 0x0 }, | |
73 { 0x85, BPF_REG_0, BPF_REG_0, (int16_t) 0, 0x52 }, | |
74 { 0xb7, BPF_REG_0, BPF_REG_0, (int16_t) 0, 0x1 }, | |
75 { 0x95, BPF_REG_0, BPF_REG_0, (int16_t) 0, 0x0 }, | |
76 }; | |
77 | |
78 | |
79 ngx_bpf_program_t ngx_quic_reuseport_helper = { | |
80 .relocs = bpf_reloc_prog_ngx_quic_reuseport_helper, | |
81 .nrelocs = sizeof(bpf_reloc_prog_ngx_quic_reuseport_helper) | |
82 / sizeof(bpf_reloc_prog_ngx_quic_reuseport_helper[0]), | |
83 .ins = bpf_insn_prog_ngx_quic_reuseport_helper, | |
84 .nins = sizeof(bpf_insn_prog_ngx_quic_reuseport_helper) | |
85 / sizeof(bpf_insn_prog_ngx_quic_reuseport_helper[0]), | |
86 .license = "BSD", | |
87 .type = BPF_PROG_TYPE_SK_REUSEPORT, | |
88 }; |