Skip to content

memcache: reject oversized value lengths in protocol parser#315

Merged
trufae merged 1 commit intomasterfrom
codex/fix-buffer-overflow-in-mcsdbd
Mar 7, 2026
Merged

memcache: reject oversized value lengths in protocol parser#315
trufae merged 1 commit intomasterfrom
codex/fix-buffer-overflow-in-mcsdbd

Conversation

@trufae
Copy link
Copy Markdown
Collaborator

@trufae trufae commented Mar 7, 2026

Motivation

  • Prevent a remote heap buffer overflow by validating client-provided bytes before using it to drive reads into the fixed per-client buffer.

Description

  • Add an upper-bound check in protocol_handle (in memcache/protocol.c) to reject write-like commands when bytes > (MCSDB_MAX_BUFFER - 2) and return CLIENT_ERROR data too big instead of switching to mode 1.

Testing

  • Built the core library with make -C src libsdb.a, which succeeded.
  • Attempted make -C memcache -j4, but the memcache build failed in this environment due to cmds.h generation/linkage issues unrelated to this patch (undefined reference to sdb_strdup), so the final memcache binary could not be produced here.

Codex Task

@trufae trufae merged commit f8442c7 into master Mar 7, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant