From 90f35cea81b48834cf3906435a2ef352f3e3e900 Mon Sep 17 00:00:00 2001 From: Binbin Date: Fri, 29 Jul 2022 06:14:18 +0800 Subject: Avoid false positive out-of-bounds in writeForgottenNodePingExt (#11053) In clusterMsgPingExtForgottenNode, sizeof(name) is CLUSTER_NAMELEN, and sizeof(clusterMsgPingExtForgottenNode) is > CLUSTER_NAMELEN. Doing a (name + sizeof(clusterMsgPingExtForgottenNode)) sanitizer generates an out-of-bounds error which is a false positive in here --- src/cluster.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/cluster.c') diff --git a/src/cluster.c b/src/cluster.c index 1612c9e83..7affc838e 100644 --- a/src/cluster.c +++ b/src/cluster.c @@ -2035,7 +2035,7 @@ int writeHostnamePingExt(clusterMsgPingExt **cursor) { (*cursor)->type = htons(CLUSTERMSG_EXT_TYPE_HOSTNAME); (*cursor)->length = htonl(extension_size); /* Make sure the string is NULL terminated by adding 1 */ - *cursor = (clusterMsgPingExt *) (ext->hostname + EIGHT_BYTE_ALIGN(sdslen(myself->hostname) + 1)); + *cursor = (clusterMsgPingExt *) ((intptr_t)ext + EIGHT_BYTE_ALIGN(sdslen(myself->hostname) + 1)); return extension_size; } @@ -2050,7 +2050,7 @@ int writeForgottenNodePingExt(clusterMsgPingExt **cursor, sds name, uint64_t ttl uint32_t extension_size = sizeof(clusterMsgPingExt) + sizeof(clusterMsgPingExtForgottenNode); (*cursor)->type = htons(CLUSTERMSG_EXT_TYPE_FORGOTTEN_NODE); (*cursor)->length = htonl(extension_size); - *cursor = (clusterMsgPingExt *) (ext->name + sizeof(clusterMsgPingExtForgottenNode)); + *cursor = (clusterMsgPingExt *) (ext + 1); return extension_size; } -- cgit v1.2.1