Re: Fix unsigned underflow in inject_cached_message

> I have reviewed the patch(011-inject-cached-message-underflow) from Emond.
> It has also passed all regression tests.
>
> This patch modifies the packet length validation in inject_cached_message to prevent
> a session crash caused by an unsigned integer underflow.
>
> Previously, the logic determined whether to process a query cache message by checking
> if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).
>
> However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.
>
> When a corrupt packet with a payload length shorter than the header size is processed,
> the subtraction underflows into a massive positive integer,
> bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
> In our local test environment, injecting a short packet successfully reproduced this exact behavior,
> causing a memory context allocation crash.
>
> The updated logic changes the condition to a direct comparison
> before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
> ensuring that invalid short packets are securely blocked and the session remains stable,
> which proves the fix is highly valid.
>
> Thank you Emond.

I have looked into the patch. It looks good to me.

Regards,
--
Tatsuo Ishii
SRA OSS K.K.
English: http://www.sraoss.co.jp/index_en/
Japanese:http://www.sraoss.co.jp