Skip to content

Commit 6a672a9

Browse files
generatedunixname26860585020226206meta-codesync[bot]
authored andcommitted
Fix OOB read in FailoverErrorsSettingsBase::shouldFailover (MACA T271785672)
Summary: `memcache/mcrouter-fbpkg` R5519-R5521 fail at the Contbuild Tracking Node: lionhead harness `CarbonResultReproFuzzerd4` reproduces a heap out-of-bounds read in `FailoverErrorsSettingsBase::List::shouldFailover`. A malicious memcache backend sends a Caret reply whose `result` field is an int16 outside `[0, NUM_RESULTS)` (`CarbonProtocolReader` casts the wire value to `carbon::Result` unchecked); `shouldFailover` then indexes `failover_[result]` — a `std::array<bool, 36>` — out of bounds. Fix: bounds-check the index before the array read, falling back to `isFailoverErrorResult` (safely returns false for unknown results). Valid results are unchanged. Sentinel-Harness: claude *Modify your team agent prompt, check stats, and leave feedback: https://www.internalfb.com/sentinel_agent/rotations/cacheclient* Model used: Claude Opus 4.8 Differential Revision: D112691076 fbshipit-source-id: 35ab5dbeae78da9a56b8d62649af6e5747483dde
1 parent d5ec9dd commit 6a672a9

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

mcrouter/lib/FailoverErrorsSettingsBase.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,10 @@ FailoverErrorsSettingsBase::List::List(const folly::dynamic& json) {
4747

4848
bool FailoverErrorsSettingsBase::List::shouldFailover(
4949
const carbon::Result result) const {
50-
if (failover_ != nullptr) {
51-
return (*failover_)[static_cast<size_t>(result)];
50+
const auto index = static_cast<size_t>(result);
51+
if (failover_ != nullptr &&
52+
index < static_cast<size_t>(carbon::Result::NUM_RESULTS)) {
53+
return (*failover_)[index];
5254
}
5355
return isFailoverErrorResult(result);
5456
}

0 commit comments

Comments
 (0)