Merge pull request #4010 from bluca/fuzzers

Problem: WS might use handshake buffer for data
This commit is contained in:
Doron Somech 2020-08-15 14:59:30 +03:00 committed by GitHub
commit 1412078db6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 2 deletions

View File

@ -238,7 +238,7 @@ uint64_t zmq::clock_t::rdtsc ()
{
#if (defined _MSC_VER && (defined _M_IX86 || defined _M_X64))
return __rdtsc ();
#elif defined(_MSC_VER) && defined(_M_ARM) // NC => added for windows ARM
#elif defined(_MSC_VER) && defined(_M_ARM) // NC => added for windows ARM
return __rdpmccntr64 ();
#elif defined(_MSC_VER) && defined(_M_ARM64) // NC => added for windows ARM64
//return __rdpmccntr64 ();

View File

@ -212,10 +212,13 @@ int zmq::ws_decoder_t::size_ready (unsigned char const *read_pos_)
// data into a new message and complete it in the next receive.
shared_message_memory_allocator &allocator = get_allocator ();
if (unlikely (!_zero_copy
if (unlikely (!_zero_copy || allocator.data () > read_pos_
|| static_cast<size_t> (read_pos_ - allocator.data ())
> allocator.size ()
|| _size > static_cast<size_t> (
allocator.data () + allocator.size () - read_pos_))) {
// a new message has started, but the size would exceed the pre-allocated arena
// (or read_pos_ is in the initial handshake buffer)
// this happens every time when a message does not fit completely into the buffer
rc = _in_progress.init_size (static_cast<size_t> (_size));
} else {