Open-Harbor/osrm-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Fixes critical error in table plugin accessing uninitialized memory

Browse Source 
Although we check for valid coordinates in the table plugin via
`check_all_coordinates`, we do not check for #srcs > 0 and #dsts > 0.

This would be fine as the grammar parser combines adding coordinates and
setting their `is_source` and `is_destination` property, which makes
adding coordinates without specifying source or destination impossible.

See: route_parameters.cpp, AddSource, AddDestination, and api_grammar.hpp

In contract, the Polyline codepath does not do this! In fact, it only lets
you set coordinates, but not their `is_source` or `is_destination` property.

See: route_parameters.cpp, SetCoordinatesFromGeometry

Therefore, the following queries only set coordinates:

    http 'http://localhost:5000/table?locs=s_hhFg{arEgEfEgEfEgEfEgEfEgEfEgEfEgEfEgEfEgEfE'
    http 'http://localhost:5000/table?locs=_p~iF~ps|U_ulLnnqC_mqNvxq`@'

but fail to specify sources and targets!

The distance table plugin now assumes `is_course` and `is_destination`
is the same size as `coordinates`.

And happily accesses uninitialized memory.
This commit is contained in:
Daniel J. Hofmann 2016-03-02 14:48:35 +01:00 committed by Patrick Niklaus
parent 0eaa393065
commit ce1ca1b625
1 changed files with 26 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
include/engine/plugins/distance_table.hpp
View File

@ -59,18 +59,31 @@ template <class DataFacadeT> class DistanceTablePlugin final : public BasePlugin
return Status::Error; return Status::Error;
} }
auto number_of_sources = // The check_all_coordinates guard above makes sure we have at least 2 coordinates.
std::count_if(route_parameters.is_source.begin(), route_parameters.is_source.end(), // This guard makes sure is_source, is_destination, coordinates are parallel arrays.
[](const bool is_source) if (route_parameters.is_source.size() != route_parameters.coordinates.size() ||
{ route_parameters.is_destination.size() != route_parameters.coordinates.size())
return is_source; {
}); json_result.values["status_message"] =
auto number_of_destination = "Number of sources and destinations does not match number of coordinates";
std::count_if(route_parameters.is_destination.begin(), return Status::Error;
route_parameters.is_destination.end(), [](const bool is_destination) }
{
return is_destination; const auto number_of_sources = std::count(route_parameters.is_source.begin(), //
}); route_parameters.is_source.end(), true);
const auto number_of_destination = std::count(route_parameters.is_destination.begin(), //
route_parameters.is_destination.end(), true);
// At this point we know that we
// - have at least n=2 coordinates and
// - have n booleans in is_source and n booleans in is_destination
// This guard makes sure we have at least one source and one target.
if (number_of_sources < 1 || number_of_destination < 1)
{
json_result.values["status_message"] =
"At least one source and one destination required";
return Status::Error;
}
if (max_locations_distance_table > 0 && if (max_locations_distance_table > 0 &&
(number_of_sources * number_of_destination > (number_of_sources * number_of_destination >
@ -123,6 +136,7 @@ template <class DataFacadeT> class DistanceTablePlugin final : public BasePlugin
const int range = input_bearings.size() > 0 const int range = input_bearings.size() > 0
? (input_bearings[i].second ? *input_bearings[i].second : 10) ? (input_bearings[i].second ? *input_bearings[i].second : 10)
: 180; : 180;
if (route_parameters.is_source[i]) if (route_parameters.is_source[i])
{ {
*phantom_node_source_out_iter = *phantom_node_source_out_iter =