[DISPATCH-1461] Crashed router due to terminus address overflow

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.9.0
• Fix Version/s: 1.10.0
• Component/s: Router Node
• Assignee: Unassigned
• Reporter: Ken Giusti
• Created: 25/Oct/19 15:43
• Updated: 20/Dec/19 12:10
• Resolved: 25/Oct/19 19:25

Description

in router_core/connections.c::qdr_link_inbound_first_attach_CT:

 

char source_str[1000];
{{ char target_str[1000];}}
{{ size_t source_len = 1000;}}
{{ size_t target_len = 1000;}}source_str[0] = '\0';
{{ target_str[0] = '\0';}}//
{{ // Grab the formatted terminus strings before we schedule any IO-thread processing that}}
{{ // might get ahead of us and free the terminus objects before we issue the log.}}
{{ //}}
{{ if (qd_log_enabled(core->log, QD_LOG_INFO)) {}}
     qdr_terminus_format(source, source_str, &source_len);
     qdr_terminus_format(target, target_str, &target_len);
{{ }}}

If the source or target terminus is too long (>1000) the output string overflows.

Issue Links

• links to: GitHub Pull Request #599