Skip to content

Commit 0985259

Browse files
authored
fix: avoid address overlap (#16)
1 parent a8c4f2f commit 0985259

File tree

3 files changed

+53
-47
lines changed

3 files changed

+53
-47
lines changed

src/http/ngx_http_wasm_api.c

Lines changed: 41 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,6 @@
44
#include "ngx_http_wasm_state.h"
55

66

7-
/* convert Word to pointer */
8-
#define WP(x) (void *) (int64_t) (x)
9-
10-
117
wasm_functype_t *
128
ngx_http_wasm_host_api_func(const ngx_wasm_host_api_t *api)
139
{
@@ -45,20 +41,52 @@ proxy_set_effective_context(int32_t id)
4541
}
4642

4743

44+
static int32_t
45+
ngx_http_wasm_copy_to_wasm(ngx_log_t *log, const u_char *data, int32_t len,
46+
int32_t addr, int32_t size_addr)
47+
{
48+
int32_t buf_addr;
49+
int32_t *p_size;
50+
int32_t *p;
51+
u_char *buf;
52+
53+
buf_addr = ngx_wasm_vm.malloc(log, len);
54+
if (buf_addr == 0) {
55+
return PROXY_RESULT_INTERNAL_FAILURE;
56+
}
57+
58+
buf = (u_char *) ngx_wasm_vm.get_memory(log, buf_addr, len);
59+
if (buf == NULL) {
60+
return PROXY_RESULT_INVALID_MEMORY_ACCESS;
61+
}
62+
63+
ngx_memcpy(buf, data, len);
64+
65+
p_size = (int32_t *) ngx_wasm_vm.get_memory(log, size_addr, sizeof(int32_t));
66+
if (p_size == NULL) {
67+
return PROXY_RESULT_INVALID_MEMORY_ACCESS;
68+
}
69+
70+
*p_size = len;
71+
72+
p = (int32_t *) ngx_wasm_vm.get_memory(log, addr, sizeof(int32_t));
73+
if (p == NULL) {
74+
return PROXY_RESULT_INVALID_MEMORY_ACCESS;
75+
}
76+
77+
*p = buf_addr;
78+
return PROXY_RESULT_OK;
79+
}
80+
81+
4882
int32_t
4983
proxy_log(int32_t log_level, int32_t addr, int32_t size)
5084
{
5185
const u_char *p;
5286
ngx_uint_t host_log_level = NGX_LOG_ERR;
53-
ngx_http_request_t *r;
5487
ngx_log_t *log;
5588

56-
r = ngx_http_wasm_get_req();
57-
if (r == NULL) {
58-
log = ngx_cycle->log;
59-
} else {
60-
log = r->connection->log;
61-
}
89+
log = ngx_http_wasm_get_log();
6290

6391
p = ngx_wasm_vm.get_memory(log, addr, size);
6492
if (p == NULL) {
@@ -102,22 +130,14 @@ proxy_get_buffer_bytes(int32_t type, int32_t start, int32_t length,
102130
int32_t addr, int32_t size_addr)
103131
{
104132
ngx_log_t *log;
105-
int32_t buf_addr;
106133
const u_char *data;
107134
int32_t len;
108-
int32_t *p_size;
109-
u_char **p;
110-
u_char *buf;
111135

112136
const ngx_str_t *conf;
113137
ngx_http_request_t *r;
114138

115139
r = ngx_http_wasm_get_req();
116-
if (r == NULL) {
117-
log = ngx_cycle->log;
118-
} else {
119-
log = r->connection->log;
120-
}
140+
log = ngx_http_wasm_get_log();
121141

122142
switch (type) {
123143
case PROXY_BUFFER_TYPE_PLUGIN_CONFIGURATION:
@@ -130,33 +150,7 @@ proxy_get_buffer_bytes(int32_t type, int32_t start, int32_t length,
130150
return PROXY_RESULT_UNIMPLEMENTED;
131151
}
132152

133-
buf_addr = ngx_wasm_vm.malloc(log, len);
134-
if (buf_addr == 0) {
135-
return PROXY_RESULT_INTERNAL_FAILURE;
136-
}
137-
138-
buf = (u_char *) ngx_wasm_vm.get_memory(log, buf_addr, len);
139-
if (buf == NULL) {
140-
return PROXY_RESULT_INVALID_MEMORY_ACCESS;
141-
}
142-
143-
ngx_memcpy(buf, data, len);
144-
145-
p_size = (int32_t *) ngx_wasm_vm.get_memory(log, size_addr, sizeof(int32_t));
146-
if (p_size == NULL) {
147-
return PROXY_RESULT_INVALID_MEMORY_ACCESS;
148-
}
149-
150-
*p_size = len;
151-
152-
p = (u_char **) ngx_wasm_vm.get_memory(log, addr, sizeof(int32_t));
153-
if (p == NULL) {
154-
return PROXY_RESULT_INVALID_MEMORY_ACCESS;
155-
}
156-
157-
*p = WP(buf_addr);
158-
159-
return PROXY_RESULT_OK;
153+
return ngx_http_wasm_copy_to_wasm(log, data, len, addr, size_addr);
160154
}
161155

162156

src/http/ngx_http_wasm_state.c

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,14 @@ ngx_http_wasm_get_req(void)
3131

3232
return cur_state->r;
3333
}
34+
35+
36+
ngx_log_t *
37+
ngx_http_wasm_get_log(void)
38+
{
39+
if (cur_state != NULL && cur_state->r != NULL) {
40+
return cur_state->r->connection->log;
41+
}
42+
43+
return ngx_cycle->log;
44+
}

src/http/ngx_http_wasm_state.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ typedef struct {
1515
void ngx_http_wasm_set_state(ngx_http_wasm_state_t *state);
1616
const ngx_str_t *ngx_http_wasm_get_conf(void);
1717
ngx_http_request_t *ngx_http_wasm_get_req(void);
18+
ngx_log_t *ngx_http_wasm_get_log(void);
1819

1920

2021
#endif // NGX_HTTP_WASM_STATE_H

0 commit comments

Comments
 (0)