Merge pull request #65 from navytux/y/bytearray8-fix

decoder: Fix integer overflow in BYTEARRAY8 handling

fuzz/corpus/132fefeffc7159624a2e0995c7aa8518ae147137-1

+F100000000__

fuzz/corpus/135ffa30ed89d2b65a9810ee8e4deee86b7b192c-8

+F7e9
+22‡22‡22‡22‡.
\ No newline at end of file

fuzz/corpus/1dd14ba6c9f26679324d071e5c893accc664b457-3

+L.L

fuzz/corpus/1efeb611651ec10e730f5d5ab81df9e152dd4295

+(lI7
+a.
\ No newline at end of file

fuzz/corpus/23305eefa3a0f9008dbc06242e954cab2e06dd9a

+V\u043c\u0438\u0440
+.
\ No newline at end of file

fuzz/corpus/2484e5a25d7424399c08185ee924ede521ec3c00-4

+F0xFe

fuzz/corpus/2c3b7e32639fa56730f1398adc4359a60f9c200f-2

+F8e0_0_3_24

fuzz/corpus/32096c2e0eff33d844ee6d675407ace18289357d

+C
\ No newline at end of file

fuzz/corpus/35a2f43f265dfa0895f1cb8259d441292610c7cc-3

+F4440892098500626161694526672363281250_0__

fuzz/corpus/39c21fbfa1ad25a912ea0cc8da6acc106fd66b1d-1

+F7e3_24

fuzz/corpus/3baf08686f974ffa31127dfdc7373b81de546fa8-3

+F0_0
+F3_

fuzz/corpus/3ef2894c2e0013bb7011e0f00f25563481593824-3

+F7e-2_

fuzz/corpus/441f522e1eadbaaf2560824b962b35fdb1236d47

+S"\xe2\x80\xa8"
+.
\ No newline at end of file

fuzz/corpus/4a6ab44fa1b849f2f66a1ca139ecfc022f3d2a00

+(lI1
+aI2
+aI3
+aI01
+a.
\ No newline at end of file

fuzz/corpus/4c0a4b3e54f404370054514a566eeaf467cf30e1-4

+F44408920985006261616945266716945266138777878078144567552953958511352539062572363282363281250_0__

fuzz/corpus/4ee0aa0ae6aa75d976a1f7a71607f8d7133af52f-4

+F0_0
+F0_0
+F0_

fuzz/corpus/4fa23cee6fb1d50e772453b3f558f751d6bc3c34-2

+F0_0__

fuzz/corpus/52a719f9d01e6a1882f97bc011e52c80f807e955

+˜
\ No newline at end of file

fuzz/corpus/5740a80ccda9297f0883c940dc90351aa1a55bf6-4

+F7e-314

fuzz/corpus/75ae1097b562c36f2c15452422ea0fd284721b10-1

+c_codecs
+encode
+J¸Ã‘ÂUlatin1†R
\ No newline at end of file

fuzz/corpus/768b6817699d155b1b03c3e67d12d3ba01fb5f8c-5

+F0_0
+F3_0
+F0_0
+F3_

fuzz/corpus/7852139e6533c593981781e5a2f2a144bee08780-1

+F-_0

fuzz/corpus/816d80c9d39a049a07896564097d46a0eea7d975

+F7e3___d

fuzz/corpus/849b4539bcdfc28a21a12a661e0d7b2a962b6bbd-1

+I_

fuzz/corpus/8e2ad525d4146a6960c4537e503360002a293956-3

+((l(dS''
+(lQsal.
\ No newline at end of file

fuzz/corpus/93acbc9575a562b62b64638700b38e44bae72670-4

+F0_0_0_0_0_0_0_0__

fuzz/corpus/95f7e42660537d5d29347d70f52f4f9175268407-4

+F7e3_________

fuzz/corpus/ab733544dbb1c42ccc9dbc10228798ea030fb4bb-3

+F0x

fuzz/corpus/ae4f281df5a5d0ff3cad6371f76d5c29b6d953ec-1

+B
\ No newline at end of file

fuzz/corpus/b3c2c74168b15db955bbd036572722ec3f153d28-1

+c__builtin__
+bytearray
+(c
+
+(ttR.
\ No newline at end of file

fuzz/corpus/b4e4e07ff0b9eaec6c15237718d54a2aa3f4cbc6

+}(U
aU
1U

2u.
\ No newline at end of file

fuzz/corpus/b523a572216d123644fffa237f931a0d8d1662f6-1

+F0_n

fuzz/corpus/b5a972d2bc35c8818ca23e6e17f5eb1cb4ace8ae

+S"\n\r\xe2\x80\xa8\u\U"
+.
\ No newline at end of file

fuzz/corpus/b63806dbe0c51cf773b3d564410761b37aa5fd0d-1

+V\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

fuzz/corpus/b8f3eec6b5fa270fb05644de403d9077b60ccbcf-1

+–
\ No newline at end of file

fuzz/corpus/ba52c29b96f28033fd4bfb32ffc42a96edb9688e-4

+F519659175926385_0_0o

fuzz/corpus/bac4c4dfadcc19cb8ad74521aebf48939213e5ee-1

+}(C

2u.
\ No newline at end of file

fuzz/corpus/bbe0dfd48edbb7a85b7934c3a0c21736b8d2f0b7-4

+F02384185791015625_0
+F3_

fuzz/corpus/c0d9f3333e250abaf6ba971fb487f74beb8cd126

+V\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

fuzz/corpus/c7d2aaba82ac8309a0e59804ca7fb96315cc26f2

+c
+
+UbingR.
\ No newline at end of file

fuzz/corpus/d0ba017a77bb7a1740c07f1f0d7dff92fdf69c39-2

+F0E0__

fuzz/corpus/d0d9a61ee0368f5586d04fd50bc241dbc4a749ab-1

+c__builtin__
+bytearray
+(Utin1tRtR
\ No newline at end of file

fuzz/corpus/d11388dfe042a6ae94e162d32f0602fd7b7f83dc-1

+}(U
aU
1U

2u.
\ No newline at end of file

fuzz/corpus/db115ce5c7ba4e7fe8f6c204c1127edda5650b7f-3

+F0_.

fuzz/corpus/db54136ebbd8435683a599b1b55c749727c0db3c-1

+c_codecs
+encode
+XÑUQQQQQQQQR.
\ No newline at end of file

fuzz/corpus/de8c9628e5094a0e9db8ff440873541a543a683d-1

+F7e3______d

fuzz/corpus/f2a7a881ea7127561610b69eb17215d2d050017b-3

+F0_0_0_0__

fuzz/corpus/f46a5feaae57492e235a05b729ab5b859a223e1e-1

+Finfi

fuzz/corpus/f4cba62107a085e4753268e261e4da21918e5629

+(lp
+.
\ No newline at end of file

fuzz/corpus/f79124bb7d5206059db6748cba8d64f335e04bcb

+c_codecs
+encode
+X¸Ã‘ÂUlatin1†R.
\ No newline at end of file

fuzz/corpus/f977929df9b5115317e6cace3409f9d36ee6f4a8-4

+F0_0
+F3_0_0
+F0_0
+F3__

fuzz/corpus/fa138ae356d35c8d77083c406a5be73745643aae-1

+—
\ No newline at end of file

fuzz/corpus/fad1d13856893f14a0657f1f1ee97184c6e37960-1

+c_codecs
+encode
+X¸Ã‘ÂClatin1†R.
\ No newline at end of file

fuzz/corpus/ff318f2bec5a87f89279884b56445580d0d53061-1

+F7e2"

ogorek.go

@@ -781,11 +781,12 @@ func (d *Decoder) bufLoadBinData8() error {
 func (d *Decoder) bufLoadBytesData(l uint64) error {
 	d.buf.Reset()
 	// don't allow malicious `BINSTRING <bigsize> nodata` to make us out of memory
-	prealloc := int(l)
-	if maxgrow := 0x10000; prealloc > maxgrow {
+	prealloc := l
+	const maxgrow = 0x10000
+	if prealloc > maxgrow {
 		prealloc = maxgrow
 	}
-	d.buf.Grow(prealloc)
+	d.buf.Grow(int(prealloc))
 	if l > math.MaxInt64 {
 		return fmt.Errorf("size([]data) > maxint64")
 	}

ogorek_test.go

@@ -839,9 +839,10 @@ func TestFuzzCrashers(t *testing.T) {
 		"(c\n\nc\n\n\x85Rd",
 		"}(U\x040000u",
 		"(\x88d",
-		"(]QNd.",       // PersID([])      -> dict
-		"}]QNs.",       // PersID([])      -> setitem
-		"}(]QNI1\nNu.", // PersID([]) ...  -> setitems
+		"(]QNd.",          // PersID([])      -> dict
+		"}]QNs.",          // PersID([])      -> setitem
+		"}(]QNI1\nNu.",    // PersID([]) ...  -> setitems
+		"\x960000000\xef", // BYTEARRAY8
 	}
 
 	for _, c := range crashers {