From: Ondřej Surý <ondrej@isc.org>
Date: Thu, 3 Dec 2020 07:33:21 +0000 (+0100)
Subject: Don't use stack allocated buffer for uv_write()
X-Git-Tag: v9.16.11~17^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c70100ce05507d76862cc7366d38ed90982e8ff;p=thirdparty%2Fbind9.git

Don't use stack allocated buffer for uv_write()

On FreeBSD, the stack is destroyed more aggressively than on Linux and
that revealed a bug where we were allocating the 16-bit len for the
TCPDNS message on the stack and the buffer got garbled before the
uv_write() sendback was executed.  Now, the len is part of the uvreq, so
we can safely pass it to the uv_write() as the req gets destroyed after
the sendcb is executed.

(cherry picked from commit 94afea932567bf1eb6ee5b80a1c7b2d4071980bd)
---

diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
index 7a19af56d17..95914755227 100644
--- a/lib/isc/netmgr/netmgr-int.h
+++ b/lib/isc/netmgr/netmgr-int.h
@@ -287,6 +287,7 @@ struct isc__nm_uvreq {
 	int magic;
 	isc_nmsocket_t *sock;
 	isc_nmhandle_t *handle;
+	char tcplen[2];	      /* The TCP DNS message length */
 	uv_buf_t uvbuf;	      /* translated isc_region_t, to be
 			       * sent or received */
 	isc_sockaddr_t local; /* local address */
diff --git a/lib/isc/netmgr/tcpdns.c b/lib/isc/netmgr/tcpdns.c
index 0b976ecdc5c..9d55f9412d2 100644
--- a/lib/isc/netmgr/tcpdns.c
+++ b/lib/isc/netmgr/tcpdns.c
@@ -1238,6 +1238,7 @@ isc__nm_tcpdns_send(isc_nmhandle_t *handle, isc_region_t *region,
 	REQUIRE(sock->type == isc_nm_tcpdnssocket);
 
 	uvreq = isc__nm_uvreq_get(sock->mgr, sock);
+	*(uint16_t *)uvreq->tcplen = htons(region->length);
 	uvreq->uvbuf.base = (char *)region->base;
 	uvreq->uvbuf.len = region->length;
 
@@ -1300,8 +1301,7 @@ tcpdns_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
 	REQUIRE(sock->type == isc_nm_tcpdnssocket);
 
 	int r;
-	uint16_t len = htons(req->uvbuf.len);
-	uv_buf_t bufs[2] = { { .base = (char *)&len, .len = 2 },
+	uv_buf_t bufs[2] = { { .base = req->tcplen, .len = 2 },
 			     { .base = req->uvbuf.base,
 			       .len = req->uvbuf.len } };