Fix use-after-free in QuicRangeRemoveRange middle-split path#5882
Open
Fix use-after-free in QuicRangeRemoveRange middle-split path#5882
Conversation
In QuicRangeRemoveRange, the Sub pointer captured before QuicRangeMakeSpace becomes dangling when MakeSpace triggers QuicRangeGrow, which frees the old heap-allocated SubRanges array. The subsequent *NewSub = *Sub reads from freed memory. Fix: copy *Sub to a stack-local QUIC_SUBRANGE before calling MakeSpace, then assign the saved value to *NewSub. Add regression test RemoveRangeMiddleSplitWithGrow that fills 16 subranges (forcing heap allocation at AllocLength=16), then splits one via RemoveRange to trigger growth from 16 to 32. Fixes: #5824 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Codecov Report❌ Patch coverage is
❌ Your patch check has failed because the patch coverage (0.00%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #5882 +/- ##
==========================================
- Coverage 86.14% 84.85% -1.29%
==========================================
Files 60 60
Lines 18732 18733 +1
==========================================
- Hits 16136 15896 -240
- Misses 2596 2837 +241 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fix use-after-free in
QuicRangeRemoveRange(src/core/range.c). In the middle-split path, theSubpointer captured beforeQuicRangeMakeSpacebecomes dangling whenMakeSpacetriggersQuicRangeGrow, which frees the old heap-allocatedSubRangesarray. The subsequent*NewSub = *Subreads from freed memory.Fix: Copy
*Subto a stack-localQUIC_SUBRANGEbefore callingMakeSpace, then assign the saved value to*NewSub.Trigger conditions (all required):
UsedLength == AllocLength(array at capacity)AllocLength > QUIC_RANGE_INITIAL_SUB_COUNT(8) old array is heap-allocatedRemoveRangeFixes #5824
Testing
New test
RangeTest.RemoveRangeMiddleSplitWithGrowadded. It fills 16 subranges (forcing heap allocation atAllocLength=16), then splits one viaRemoveRangeto trigger growth from 16 to 32.Verified with Application Verifier (Page Heap):
SEH exception 0xc0000005(access violation)Documentation
No documentation impact.