Skip to content

Commit

Permalink
io: fix take when using evil reader (#4428)
Browse files Browse the repository at this point in the history
  • Loading branch information
Darksonn authored and carllerche committed Jan 27, 2022
1 parent 2273eb1 commit 6d552e2
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 1 deletion.
5 changes: 5 additions & 0 deletions tokio/src/io/util/take.rs
Original file line number Diff line number Diff line change
Expand Up @@ -84,9 +84,14 @@ impl<R: AsyncRead> AsyncRead for Take<R> {
return Poll::Ready(Ok(()));
}

let buf_ptr = buf.filled().as_ptr();

let me = self.project();
let mut b = buf.take(*me.limit_ as usize);

ready!(me.inner.poll_read(cx, &mut b))?;
assert_eq!(b.filled().as_ptr(), buf_ptr);

let n = b.filled().len();

// We need to update the original ReadBuf
Expand Down
30 changes: 29 additions & 1 deletion tokio/tests/io_take.rs
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
#![warn(rust_2018_idioms)]
#![cfg(feature = "full")]

use tokio::io::AsyncReadExt;
use std::pin::Pin;
use std::task::{Context, Poll};
use tokio::io::{self, AsyncRead, AsyncReadExt, ReadBuf};
use tokio_test::assert_ok;

#[tokio::test]
Expand All @@ -14,3 +16,29 @@ async fn take() {
assert_eq!(n, 4);
assert_eq!(&buf, &b"hell\0\0"[..]);
}

struct BadReader;

impl AsyncRead for BadReader {
fn poll_read(
self: Pin<&mut Self>,
_cx: &mut Context<'_>,
read_buf: &mut ReadBuf<'_>,
) -> Poll<io::Result<()>> {
let vec = vec![0; 10];

let mut buf = ReadBuf::new(vec.leak());
buf.put_slice(&[123; 10]);
*read_buf = buf;

Poll::Ready(Ok(()))
}
}

#[tokio::test]
#[should_panic]
async fn bad_reader_fails() {
let mut buf = Vec::with_capacity(10);

BadReader.take(10).read_buf(&mut buf).await.unwrap();
}

0 comments on commit 6d552e2

Please sign in to comment.