Skip to content

build: bump libevent to c4fbae3a.#6062

Merged
htuch merged 11 commits intoenvoyproxy:masterfrom
htuch:libevent-repro
Mar 5, 2019
Merged

build: bump libevent to c4fbae3a.#6062
htuch merged 11 commits intoenvoyproxy:masterfrom
htuch:libevent-repro

Conversation

@htuch
Copy link
Copy Markdown
Member

@htuch htuch commented Feb 25, 2019

This brings in buffer correctness fixes for libevent/libevent#774 and libevent/libevent#778.

This will temporarily take us away from a released version until 2.1.9.

Fixes oss-fuzz issue https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13400.

Risk level: Low (since we're already at 2.1.9-beta, which is pretty near in history).
Testing: regression unit tests added upstream in libevent, corpus entry added.

Signed-off-by: Harvey Tuch htuch@google.com

@htuch
Copy link
Copy Markdown
Member Author

htuch commented Feb 27, 2019

Tagging libevent/libevent#778

azat added a commit to libevent/libevent that referenced this pull request Mar 3, 2019
In case we have empty chain (chain that do not have any data, i.e. ->off
== 0) at the beginning of the buffer, and no more full chains to move to
the dst, we will skip moving of this empty chain, and hence
last_with_datap will not be adjusted, and things will be broken after.

Fix this by not relying on ->off, just count if we have something to
move that's it.

Test case from:
  envoyproxy/envoy#6062

Fixes: #774
azat added a commit to libevent/libevent that referenced this pull request Mar 3, 2019
advance_last_with_data() adjusts evbuffer.last_with_datap, and if we
will have empty chain in the middle advance_last_with_data() will stop,
while it should not, since while empty chains is not regular thing they
can pops up in various places like, and while I did not look through all
of them the most tricky I would say is:
  evbuffer_reverse_space()/evbuffer_commit_space()
  evbuffer_add_reference()

Test case from:
  envoyproxy/envoy#6062

Fixes: #778

v2: keep last_with_datap really last with data, i.e. update only if
chain has data in it
htuch added 4 commits March 4, 2019 17:16
Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Harvey Tuch <htuch@google.com>
@htuch htuch changed the title [WiP] event: minimal reproducer using libevent for bug behind https:/… build: bump libevent to c4fbae3a. Mar 4, 2019
@htuch htuch marked this pull request as ready for review March 4, 2019 22:46
htuch added 2 commits March 4, 2019 17:51
Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Harvey Tuch <htuch@google.com>
@htuch htuch merged commit 8052ec6 into envoyproxy:master Mar 5, 2019
@htuch htuch deleted the libevent-repro branch March 5, 2019 12:49
fredlas pushed a commit to fredlas/envoy that referenced this pull request Mar 5, 2019
This brings in buffer correctness fixes for libevent/libevent#774 and libevent/libevent#778.

This will temporarily take us away from a released version until 2.1.9.

Fixes oss-fuzz issue https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13400.

Risk level: Low (since we're already at 2.1.9-beta, which is pretty near in history).
Testing: regression unit tests added upstream in libevent, corpus entry added.

Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Fred Douglas <fredlas@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants