From 2e73fe6c85298b5ece05ff4e79e7509cb7a6d17e Mon Sep 17 00:00:00 2001 From: ubeddulla khan Date: Wed, 8 Jul 2026 11:02:16 +0530 Subject: [PATCH] fix char-signedness out-of-bounds read in url and header lookup tables --- src/brpc/uri.cpp | 4 ++-- src/butil/containers/case_ignored_flat_map.h | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/brpc/uri.cpp b/src/brpc/uri.cpp index 5391368cf2..cb48a43d90 100644 --- a/src/brpc/uri.cpp +++ b/src/brpc/uri.cpp @@ -168,7 +168,7 @@ int URI::SetHttpURL(const char* url) { bool need_scheme = true; bool need_user_info = true; for (; true; ++p) { - const char action = g_url_parsing_fast_action_map[(int)*p]; + const char action = g_url_parsing_fast_action_map[(signed char)*p]; if (action == URI_PARSE_CONTINUE) { continue; } @@ -256,7 +256,7 @@ int ParseURL(const char* url, bool need_scheme = true; bool need_user_info = true; for (; true; ++p) { - const char action = g_url_parsing_fast_action_map[(int)*p]; + const char action = g_url_parsing_fast_action_map[(signed char)*p]; if (action == URI_PARSE_CONTINUE) { continue; } diff --git a/src/butil/containers/case_ignored_flat_map.h b/src/butil/containers/case_ignored_flat_map.h index 909e731788..13b36eb696 100644 --- a/src/butil/containers/case_ignored_flat_map.h +++ b/src/butil/containers/case_ignored_flat_map.h @@ -29,7 +29,11 @@ namespace butil { // note: using char caused crashes on ubuntu 20.04 aarch64 (VM on apple M1) inline char ascii_tolower(int/*note*/ c) { extern const signed char* const g_tolower_map; - return g_tolower_map[c]; + // g_tolower_map is biased by +128 and sized for a signed-char index + // ([-128,127]). Callers pass a `char`; on platforms where `char` is + // unsigned (aarch64, riscv64) a byte >= 0x80 arrives here as 128..255 and + // indexes past the 256-entry table. Fold back into signed-char range. + return g_tolower_map[(signed char)c]; } struct CaseIgnoredHasher {