Commit 6a672a9
Fix OOB read in FailoverErrorsSettingsBase::shouldFailover (MACA T271785672)
Summary:
`memcache/mcrouter-fbpkg` R5519-R5521 fail at the Contbuild Tracking Node: lionhead harness `CarbonResultReproFuzzerd4` reproduces a heap out-of-bounds read in `FailoverErrorsSettingsBase::List::shouldFailover`. A malicious memcache backend sends a Caret reply whose `result` field is an int16 outside `[0, NUM_RESULTS)` (`CarbonProtocolReader` casts the wire value to `carbon::Result` unchecked); `shouldFailover` then indexes `failover_[result]` — a `std::array<bool, 36>` — out of bounds. Fix: bounds-check the index before the array read, falling back to `isFailoverErrorResult` (safely returns false for unknown results). Valid results are unchanged.
Sentinel-Harness: claude
*Modify your team agent prompt, check stats, and leave feedback: https://www.internalfb.com/sentinel_agent/rotations/cacheclient*
Model used: Claude Opus 4.8
Differential Revision: D112691076
fbshipit-source-id: 35ab5dbeae78da9a56b8d62649af6e5747483dde1 parent d5ec9dd commit 6a672a9
1 file changed
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
50 | | - | |
51 | | - | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
52 | 54 | | |
53 | 55 | | |
54 | 56 | | |
| |||
0 commit comments