Skip to content

jets: fix buffer overrun#1027

Merged
pkova merged 1 commit into
developfrom
dozreg/cqes-buffer-overrun
Jun 5, 2026
Merged

jets: fix buffer overrun#1027
pkova merged 1 commit into
developfrom
dozreg/cqes-buffer-overrun

Conversation

@dozreg-toplud
Copy link
Copy Markdown
Contributor

Wasn't that a buffer overrun? buf_w[8] is outside of the atom buffer.

@dozreg-toplud dozreg-toplud requested a review from a team as a code owner June 4, 2026 11:19
@dozreg-toplud dozreg-toplud requested a review from joemfb June 4, 2026 15:15
Copy link
Copy Markdown
Collaborator

@joemfb joemfb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed this in ccrs. This fix is correct, the old code was wrong, but almost always (1 / (2^32 - 1)) effectively correct anyway (since random garbage will likely not have all bits set, and a refcount will certainly not have all bits set).

@dozreg-toplud
Copy link
Copy Markdown
Contributor Author

I think this reasoning applies for well-formed input, i.e. input for which this function should return one. I guess if a jet was called in such a way that this function got an eight word-long atom which was greater than now_w buffer we would get a false positive and a jet mismatch: the function would compute some result instead of crashing.

If in practice that function was called with only well-formed inputs then there's nothing to worry about.

@pkova pkova merged commit a559748 into develop Jun 5, 2026
2 checks passed
@pkova pkova deleted the dozreg/cqes-buffer-overrun branch June 5, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants