Memory-safety bugs found by running the test suite, including the Apache/renderd integration tests, under AddressSanitizer and UBSan.
- **Double free at renderd shutdown**: `free_renderd_section()` and `free_map_section()` took their struct by value, so clearing it afterwards only cleared a copy. Unused sections were freed at startup and again at exit. They now take a pointer. - **HTCP purge packets** were built by casting odd buffer offsets to `uint16_t*`/`uint32_t*` (undefined behaviour; faults on strict-alignment CPUs). The packets are byte-for-byte identical after the fix. - `request_queue` read `xmlname[i]` before checking the bound; the TCP hostname in `render_submit_queue` was not NUL-terminated. - #486's `process_config_string_with_trailing_slash()` leaked memory, read `src[-1]` for an empty `uri`, and was declared to return a value it never returned. An empty `uri` still becomes `/` as before. - `gen_tile_test`: an uninitialised fd and struct that only passed by luck. Independent of the other PRs in this series; it applies to `master` on its own and merges cleanly with each of them in any order. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01YForD7qSL9LT6FhMuAoKPV You can view, comment on, or merge this pull request online at: https://github.com/openstreetmap/mod_tile/pull/507 -- Commit Summary -- * Fix out-of-bounds read and unterminated hostname found with ASan * Fix unaligned HTCP writes and double free of renderd config sections * renderd_config: fix leak and out-of-bounds read in URI trailing slash code -- File Changes -- M includes/renderd_config.h (4) M src/cache_expire.c (31) M src/render_submit_queue.c (3) M src/renderd.c (2) M src/renderd_config.c (67) M src/request_queue.c (2) M tests/gen_tile_test.cpp (4) -- Patch Links -- https://github.com/openstreetmap/mod_tile/pull/507.patch https://github.com/openstreetmap/mod_tile/pull/507.diff -- Reply to this email directly or view it on GitHub: https://github.com/openstreetmap/mod_tile/pull/507 You are receiving this because you are subscribed to this thread. Message ID: <openstreetmap/mod_tile/pull/[email protected]>
_______________________________________________ Tile-serving mailing list [email protected] https://lists.openstreetmap.org/listinfo/tile-serving
