From 043fdfad1d307ecb4fb14bfe9c7b84f1c250203e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= Date: Thu, 16 Apr 2026 00:27:14 +0800 Subject: [PATCH] Fix use-after-free of pooled value buffers in bbolt Batch writes --- experimental/cachefile/dns_cache.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/experimental/cachefile/dns_cache.go b/experimental/cachefile/dns_cache.go index 914c7e5ad..55718c59a 100644 --- a/experimental/cachefile/dns_cache.go +++ b/experimental/cachefile/dns_cache.go @@ -52,6 +52,10 @@ func (c *CacheFile) LoadDNSCache(transportName string, qName string, qType uint1 } func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time) error { + value := buf.Get(8 + len(rawMessage)) + defer buf.Put(value) + binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix())) + copy(value[8:], rawMessage) return c.batch(func(tx *bbolt.Tx) error { bucket, err := c.createBucket(tx, bucketDNSCache) if err != nil { @@ -65,10 +69,6 @@ func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint1 binary.BigEndian.PutUint16(key, qType) copy(key[2:], qName) defer buf.Put(key) - value := buf.Get(8 + len(rawMessage)) - defer buf.Put(value) - binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix())) - copy(value[8:], rawMessage) return bucket.Put(key, value) }) }