Remzona54/sing-box
1
0
Fork 0
mirror of https://github.com/SagerNet/sing-box.git synced 2026-05-13 13:57:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix use-after-free of pooled value buffers in bbolt Batch writes

Browse source
This commit is contained in:
世界 2026-04-16 00:27:14 +08:00
parent 90a642ef96
commit fee6afdbf5
No known key found for this signature in database
GPG key ID: CD109927C34A63C4
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
experimental/cachefile/dns_cache.go
View file

@ -52,6 +52,10 @@ func (c *CacheFile) LoadDNSCache(transportName string, qName string, qType uint1
}
func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time) error {
value := buf.Get(8 + len(rawMessage))
defer buf.Put(value)
binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix()))
copy(value[8:], rawMessage)
return c.batch(func(tx *bbolt.Tx) error {
bucket, err := c.createBucket(tx, bucketDNSCache)
if err != nil {
@ -65,10 +69,6 @@ func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint1
binary.BigEndian.PutUint16(key, qType)
copy(key[2:], qName)
defer buf.Put(key)
value := buf.Get(8 + len(rawMessage))
defer buf.Put(value)
binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix()))
copy(value[8:], rawMessage)
return bucket.Put(key, value)
})
}