cloudwego / hertz

Go HTTP framework with high-performance and strong-extensibility for building micro-services.
https://www.cloudwego.io
Apache License 2.0
5.04k stars 491 forks source link

fix: hertz panic when edit ctx.Params on HandleFunc #1150

Closed 3DRX closed 1 month ago

3DRX commented 1 month ago

What type of PR is this?

fix

Check the PR title.

(Optional) Translate the PR title into Chinese.

修复因用户在 HandleFunc 中修改 ctx.Params 值导致的 panic

(Optional) More detailed description for this PR(en: English/zh: Chinese).

en: This panic is happening because RequestContext.ResetWithoutConn only reset the length of Params (slice), not the array itself. Therefore, if the Params is re-assigned to another array by the user, it is possible that the capacity is not enough, leading to an out of bound array index. To fix this, we need to compare the current capacity and the expected capacity in RequestContext.ResetWithoutConn, and if they do not match, realloc Params. zh(optional):

(Optional) Which issue(s) this PR fixes:

Fixes #1149

(Optional) The PR that updates user documentation:

CLAassistant commented 1 month ago

CLA assistant check
All committers have signed the CLA.

Duslia commented 1 month ago

把 reset 里的逻辑挪到这里判断吧 https://github.com/cloudwego/hertz/blob/develop/pkg/route/engine.go#L753。这里是离使用最近的一个地方,怕还有其他的地方有一些错误使用,导致这里 panic 了。

3DRX commented 1 month ago

把 reset 里的逻辑挪到这里判断吧 https://github.com/cloudwego/hertz/blob/develop/pkg/route/engine.go#L753。这里是离使用最近的一个地方,怕还有其他的地方有一些错误使用,导致这里 panic 了。

改了,由于这个逻辑移动到了 RequestContext 外部,因此添加了 GetParamsCount 函数来访问 Params 原有的长度。