Changeset 7f6e52f for db/threaded.cc

Timestamp:

10/04/09 14:52:53 (4 years ago)

Author:

Antti-Juhani Kaijanaho <antti-juhani@…>

Branches:

master

Children:

b3686ec

Parents:

2557eca

git-author:

Antti-Juhani Kaijanaho <antti-juhani@…> (10/04/09 14:52:53)

git-committer:

Antti-Juhani Kaijanaho <antti-juhani@…> (10/04/09 14:52:53)

Message:

[SECURITY] [db::threaded] Fix handling of sibling_iterator

This caused a DoS vulnerability that was remote exploitable by at least
mirroring the https facet.

Signed-off-by: Antti-Juhani Kaijanaho <antti-juhani@…>

File:

• db/threaded.cc (modified) (3 diffs)

db/threaded.cc

@@ -50 +50 @@
                         if (!tn->parent) return ptr();
                         std::list<ptr>::iterator it = tn->sibling_iterator;
+                        assert(it != tn->parent->children.end());
                         it++;
                         if (it == tn->parent->children.end())
@@ -78 +79 @@
                 p->children.push_back(shared_from_this());
                 sibling_iterator = p->children.end();
+                assert(sibling_iterator != p->children.begin());
                 sibling_iterator--;
         }
@@ -126 +128 @@
                         else
                         {
-                                children.insert(it, 
-                                                (*it)->children.begin(),
-                                                (*it)->children.end());
+                                for (std::list<ptr>::iterator jt =
+                                             (*it)->children.begin();
+                                     jt != (*it)->children.end();
+                                     jt++)
+                                {
+                                        (*jt)->sibling_iterator =
+                                                children.insert(it, *jt);
+                                        (*jt)->parent = shared_from_this();
+                                }
+
                                 std::list<ptr>::iterator next = it;
                                 next++;
                                 children.erase(it);
+                                (*it)->parent.reset();
                                 it = next;
                         }