GitHub/libevent
1
0
Fork 0
mirror of https://github.com/libevent/libevent.git synced 2025-01-31 09:12:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix divide-by-zero in ev_token_bucket_get_tick_

Browse Source 
Found by oss-fuzz, after coverage had been improved in https://github.com/google/oss-fuzz/pull/11257
This commit is contained in:
Azat Khuzhin 2024-02-20 08:58:04 +01:00
parent ec8d7a5a7b
commit c4fb0f7603
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
bufferevent_ratelim.c
View File

@ -146,11 +146,19 @@ ev_token_bucket_cfg_new(size_t read_rate, size_t read_burst,
{
struct ev_token_bucket_cfg *r;
struct timeval g;
unsigned msec_per_tick;
if (! tick_len) {
g.tv_sec = 1;
g.tv_usec = 0;
tick_len = &g;
}
msec_per_tick = (tick_len->tv_sec * 1000) +
(tick_len->tv_usec & COMMON_TIMEOUT_MICROSECONDS_MASK)/1000;
if (!msec_per_tick)
return NULL;
if (read_rate > read_burst || write_rate > write_burst ||
read_rate < 1 || write_rate < 1)
return NULL;
@ -167,8 +175,7 @@ ev_token_bucket_cfg_new(size_t read_rate, size_t read_burst,
r->read_maximum = read_burst;
r->write_maximum = write_burst;
memcpy(&r->tick_timeout, tick_len, sizeof(struct timeval));
r->msec_per_tick = (tick_len->tv_sec * 1000) +
(tick_len->tv_usec & COMMON_TIMEOUT_MICROSECONDS_MASK)/1000;
r->msec_per_tick = msec_per_tick;
return r;
}

13
test/regress_bufferevent.c
View File

@ -203,6 +203,17 @@ static void test_bufferevent_pair_flush_normal(void) { test_bufferevent_impl(1,
static void test_bufferevent_pair_flush_flush(void) { test_bufferevent_impl(1, BEV_FLUSH); }
static void test_bufferevent_pair_flush_finished(void) { test_bufferevent_impl(1, BEV_FINISHED); }
static void test_bufferevent_ratelimit_fuzz(void)
{
struct timeval cfg_tick = {0, 0};
struct ev_token_bucket_cfg *cfg = ev_token_bucket_cfg_new(1, 1, 1, 1, &cfg_tick);
tt_ptr_op(cfg, ==, NULL);
test_ok = 1;
end:
;
}
#if defined(EVTHREAD_USE_PTHREADS_IMPLEMENTED)
/**
* Trace lock/unlock/alloc/free for locks.
@ -1463,6 +1474,8 @@ struct testcase_t bufferevent_testcases[] = {
test_bufferevent_read_failed,
TT_FORK|TT_NEED_SOCKETPAIR|TT_NEED_BASE, &basic_setup, NULL },
LEGACY(bufferevent_ratelimit_fuzz, TT_ISOLATED),
END_OF_TESTCASES,
};