kentonv/capnproto — pull request #63 by Ralith (2014-01-03 03:52:59+00:00)
Title: Fix bounds check passing for relative struct pointers with offsets that underflow

Fixes segfaults (reads from unallocated memory) that can happen when using SegmentArrayMessageReader on invalid data.

This problem was identified by hosing down a capnproto-using server that takes flat-form messages as UDP datagrams with random data. Rarely, a datagram would come in whose first word appeared to be a struct pointer with a very large negative offset. The computation of the structure start address would then underflow. As WireHelpers::boundsCheck did not account for this possibility, the resulting pointer was be treated as valid and dereferenced during SegmentArrayMessageReader::getRoot().

It's not obvious that this is the only case where additional checking to handle overflow is necessary, but I haven't been able to produce any more crashes in my server after applying this fix.