INTERNAL: Fix an overwrite issue for the big key

naver · Jan 23, 2025 · 23d7e47 · 23d7e47
1 parent 6804888
commit 23d7e47
Showing 1 changed file with 47 additions and 30 deletions.
diff --git a/libmemcached/response.cc b/libmemcached/response.cc
@@ -76,27 +76,27 @@ static memcached_return_t textual_value_fetch(memcached_server_write_instance_st
   string_ptr= buffer;
   string_ptr+= 6; /* "VALUE " */
 
-
   /* We load the key */
   {
-    char *key;
-    size_t prefix_length;
+    char *key= result->item_key;
+    size_t key_length= 0;
 
-    key= result->item_key;
-    result->key_length= 0;
+    string_ptr += memcached_array_size(ptr->root->_namespace); /* prefix length */
 
-    for (prefix_length= memcached_array_size(ptr->root->_namespace); !(iscntrl(*string_ptr) || isspace(*string_ptr)) ; string_ptr++)
-    {
-      if (prefix_length == 0)
-      {
-        *key= *string_ptr;
-        key++;
-        result->key_length++;
+    while (!iscntrl(*string_ptr) && !isspace(*string_ptr)) {
+      if (key_length < MEMCACHED_MAX_KEY) {
+        key[key_length]= *string_ptr;
+      } else if (key_length == MEMCACHED_MAX_KEY) {
+        memcached_set_error(*ptr, MEMCACHED_KEY_TOO_BIG, MEMCACHED_AT);
       }
-      else
-        prefix_length--;
+      key_length++;
+      string_ptr++;
     }
-    result->item_key[result->key_length]= 0;
+
+    if (key_length < MEMCACHED_MAX_KEY) key[key_length]= 0;
+    else key[MEMCACHED_MAX_KEY - 1]= 0;
+
+    result->key_length= key_length;
   }
 
   if (end_ptr == string_ptr)
@@ -508,7 +508,6 @@ static memcached_return_t binary_read_one_response(memcached_server_write_instan
       /* FALLTHROUGH */
     case PROTOCOL_BINARY_CMD_GETK:
       {
-        uint16_t keylen= header.response.keylen;
         memcached_result_reset(result);
         result->item_cas= header.response.cas;
 
@@ -521,26 +520,44 @@ static memcached_return_t binary_read_one_response(memcached_server_write_instan
         result->item_flags= ntohl(result->item_flags);
         bodylen -= header.response.extlen;
 
-        result->key_length= keylen;
-        if (memcached_failed(rc= memcached_safe_read(ptr, result->item_key, keylen)))
+        uint16_t keylen= header.response.keylen;
+        uint16_t prefix_size= memcached_array_size(ptr->root->_namespace);
+
+        if (prefix_size >= keylen) {
+          return memcached_set_error(*ptr, MEMCACHED_UNKNOWN_READ_FAILURE, MEMCACHED_AT);
+        }
+
+        /* Discard the prefix */
+        if (memcached_failed(memcached_safe_read(ptr, NULL, prefix_size)))
         {
-          WATCHPOINT_ERROR(rc);
           return MEMCACHED_UNKNOWN_READ_FAILURE;
         }
 
-        // Only bother with doing this if key_length > 0
-        if (result->key_length)
+        bodylen -= prefix_size;
+        keylen -= prefix_size;
+
+        uint16_t read_size;
+        if (keylen < MEMCACHED_MAX_KEY) {
+          read_size= keylen;
+        } else {
+          read_size= MEMCACHED_MAX_KEY - 1;
+          memcached_set_error(*ptr, MEMCACHED_KEY_TOO_BIG, MEMCACHED_AT);
+        }
+
+        if (memcached_failed(rc= memcached_safe_read(ptr, result->item_key, read_size)))
         {
-          if (memcached_array_size(ptr->root->_namespace) and memcached_array_size(ptr->root->_namespace) >= result->key_length)
-          {
-            return memcached_set_error(*ptr, MEMCACHED_UNKNOWN_READ_FAILURE, MEMCACHED_AT);
-          }
+          WATCHPOINT_ERROR(rc);
+          return MEMCACHED_UNKNOWN_READ_FAILURE;
+        }
 
-          if (memcached_array_size(ptr->root->_namespace))
-          {
-            result->key_length-= memcached_array_size(ptr->root->_namespace);
-            memmove(result->item_key, result->item_key +memcached_array_size(ptr->root->_namespace), result->key_length);
-          }
+        result->item_key[read_size]= 0;
+        result->key_length= keylen;
+
+        /* Discard the part of key */
+        if (read_size < keylen &&
+            memcached_failed(memcached_safe_read(ptr, NULL, keylen - read_size)))
+        {
+          return MEMCACHED_UNKNOWN_READ_FAILURE;
         }
 
         bodylen -= keylen;