Add protection code to prevent etcd from panic when the client api version is not valid UTF-8 string #13560
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This fixes OSS-fuzz issue 42947 |
@AdamKorcz Could you please provide a link to the issue 42947? |
|
Thanks. I got a response of "Access Denied". It seems that only the etcd maintainers have the access. |
ahrtr
force-pushed
the
protect_invalid_client_api_version
branch
from
0902569 to
02debc4
Compare
|
Just rebased the PR. |
ptabor
approved these changes
Jan 12, 2022
Thanks for the comment. Just raised a separate ticket issues/13592 to add the case. |
…rsion is not valid UTF-8
ahrtr
force-pushed
the
protect_invalid_client_api_version
branch
from
02debc4 to
f8aafea
Compare
|
Just rebased this PR and added an item to CHANGELOG-3.6 |
ptabor
approved these changes
Jan 17, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix issues/13553.
If applications use clientv3, then this issue will never happen.
But If the client application sends data with invalid client-api-version directly to etcdserver via tcp connection, then the etcd server may be panic. Accordingly there is a security concern that the malicious program may take down the etcd server. So the PR is to fix the security concern.