Merge pull request #65 from navytux/y/bytearray8-fix

decoder: Fix integer overflow in BYTEARRAY8 handling

Merge pull request #65 from navytux/y/bytearray8-fix
decoder: Fix integer overflow in BYTEARRAY8 handling
9ca4a70a · Kamil Kisiel · GitHub · 72a53b61 · 4f485784 · 9ca4a70a
Commit 9ca4a70a authored Jul 12, 2024 by Kamil Kisiel Committed by GitHub Jul 12, 2024
75 changed files
--- a/fuzz/corpus/12d6ac791f5cd99c4a73413a37ecac0c52e0bf1b-4
+++ b/fuzz/corpus/12d6ac791f5cd99c4a73413a37ecac0c52e0bf1b-4
--- a/fuzz/corpus/132fefeffc7159624a2e0995c7aa8518ae147137-1
+++ b/fuzz/corpus/132fefeffc7159624a2e0995c7aa8518ae147137-1
+F100000000__
--- a/fuzz/corpus/135ffa30ed89d2b65a9810ee8e4deee86b7b192c-8
+++ b/fuzz/corpus/135ffa30ed89d2b65a9810ee8e4deee86b7b192c-8
+F7e9
+22‡22‡22‡22‡.
\ No newline at end of file
--- a/fuzz/corpus/1aaf78ce94359b4744eec8c3413539cd76b59f79-1
+++ b/fuzz/corpus/1aaf78ce94359b4744eec8c3413539cd76b59f79-1
--- a/fuzz/corpus/1dd14ba6c9f26679324d071e5c893accc664b457-3
+++ b/fuzz/corpus/1dd14ba6c9f26679324d071e5c893accc664b457-3
+L.L
--- a/fuzz/corpus/1efeb611651ec10e730f5d5ab81df9e152dd4295
+++ b/fuzz/corpus/1efeb611651ec10e730f5d5ab81df9e152dd4295
+(lI7
+a.
\ No newline at end of file
--- a/fuzz/corpus/23305eefa3a0f9008dbc06242e954cab2e06dd9a
+++ b/fuzz/corpus/23305eefa3a0f9008dbc06242e954cab2e06dd9a
+V\u043c\u0438\u0440
+.
\ No newline at end of file
--- a/fuzz/corpus/2484e5a25d7424399c08185ee924ede521ec3c00-4
+++ b/fuzz/corpus/2484e5a25d7424399c08185ee924ede521ec3c00-4
+F0xFe
--- a/fuzz/corpus/27491f82ac0e1a8ac76e710492ff7ffcdaea0b44-3
+++ b/fuzz/corpus/27491f82ac0e1a8ac76e710492ff7ffcdaea0b44-3
--- a/fuzz/corpus/2c3b7e32639fa56730f1398adc4359a60f9c200f-2
+++ b/fuzz/corpus/2c3b7e32639fa56730f1398adc4359a60f9c200f-2
+F8e0_0_3_24
--- a/fuzz/corpus/32096c2e0eff33d844ee6d675407ace18289357d
+++ b/fuzz/corpus/32096c2e0eff33d844ee6d675407ace18289357d
+C
\ No newline at end of file
--- a/fuzz/corpus/35a2f43f265dfa0895f1cb8259d441292610c7cc-3
+++ b/fuzz/corpus/35a2f43f265dfa0895f1cb8259d441292610c7cc-3
+F4440892098500626161694526672363281250_0__
--- a/fuzz/corpus/39c21fbfa1ad25a912ea0cc8da6acc106fd66b1d-1
+++ b/fuzz/corpus/39c21fbfa1ad25a912ea0cc8da6acc106fd66b1d-1
+F7e3_24
--- a/fuzz/corpus/3baf08686f974ffa31127dfdc7373b81de546fa8-3
+++ b/fuzz/corpus/3baf08686f974ffa31127dfdc7373b81de546fa8-3
+F0_0
+F3_
--- a/fuzz/corpus/3defda83a79c9975cd7830c83ffcdfbcb5a6b869-3
+++ b/fuzz/corpus/3defda83a79c9975cd7830c83ffcdfbcb5a6b869-3
--- a/fuzz/corpus/3ef2894c2e0013bb7011e0f00f25563481593824-3
+++ b/fuzz/corpus/3ef2894c2e0013bb7011e0f00f25563481593824-3
+F7e-2_
--- a/fuzz/corpus/4361833d20e481a5afe44a25b2295839f1c2c44f-4
+++ b/fuzz/corpus/4361833d20e481a5afe44a25b2295839f1c2c44f-4
--- a/fuzz/corpus/43b161e1b1136cabcf66508b0deb8a24e91cf596-2
+++ b/fuzz/corpus/43b161e1b1136cabcf66508b0deb8a24e91cf596-2
--- a/fuzz/corpus/441f522e1eadbaaf2560824b962b35fdb1236d47
+++ b/fuzz/corpus/441f522e1eadbaaf2560824b962b35fdb1236d47
+S"\xe2\x80\xa8"
+.
\ No newline at end of file
--- a/fuzz/corpus/4a6ab44fa1b849f2f66a1ca139ecfc022f3d2a00
+++ b/fuzz/corpus/4a6ab44fa1b849f2f66a1ca139ecfc022f3d2a00
+(lI1
+aI2
+aI3
+aI01
+a.
\ No newline at end of file
--- a/fuzz/corpus/4c0a4b3e54f404370054514a566eeaf467cf30e1-4
+++ b/fuzz/corpus/4c0a4b3e54f404370054514a566eeaf467cf30e1-4
+F44408920985006261616945266716945266138777878078144567552953958511352539062572363282363281250_0__
--- a/fuzz/corpus/4ee0aa0ae6aa75d976a1f7a71607f8d7133af52f-4
+++ b/fuzz/corpus/4ee0aa0ae6aa75d976a1f7a71607f8d7133af52f-4
+F0_0
+F0_0
+F0_
--- a/fuzz/corpus/4fa23cee6fb1d50e772453b3f558f751d6bc3c34-2
+++ b/fuzz/corpus/4fa23cee6fb1d50e772453b3f558f751d6bc3c34-2
+F0_0__
--- a/fuzz/corpus/50270c6268277b9a081d140082b658e782942b49-1
+++ b/fuzz/corpus/50270c6268277b9a081d140082b658e782942b49-1
--- a/fuzz/corpus/52a719f9d01e6a1882f97bc011e52c80f807e955
+++ b/fuzz/corpus/52a719f9d01e6a1882f97bc011e52c80f807e955
+˜
\ No newline at end of file
--- a/fuzz/corpus/5479555f7de1662c5fe8fc87ee5b726c6aae002f-12
+++ b/fuzz/corpus/5479555f7de1662c5fe8fc87ee5b726c6aae002f-12
--- a/fuzz/corpus/5740a80ccda9297f0883c940dc90351aa1a55bf6-4
+++ b/fuzz/corpus/5740a80ccda9297f0883c940dc90351aa1a55bf6-4
+F7e-314
--- a/fuzz/corpus/607a32f03b2cfab15c109f3aba388ccc58320b4b
+++ b/fuzz/corpus/607a32f03b2cfab15c109f3aba388ccc58320b4b
--- a/fuzz/corpus/75ae1097b562c36f2c15452422ea0fd284721b10-1
+++ b/fuzz/corpus/75ae1097b562c36f2c15452422ea0fd284721b10-1
+c_codecs
+encode
+J¸Ã‘ÂUlatin1†R
\ No newline at end of file
--- a/fuzz/corpus/768b6817699d155b1b03c3e67d12d3ba01fb5f8c-5
+++ b/fuzz/corpus/768b6817699d155b1b03c3e67d12d3ba01fb5f8c-5
+F0_0
+F3_0
+F0_0
+F3_
--- a/fuzz/corpus/7852139e6533c593981781e5a2f2a144bee08780-1
+++ b/fuzz/corpus/7852139e6533c593981781e5a2f2a144bee08780-1
+F-_0
--- a/fuzz/corpus/816d80c9d39a049a07896564097d46a0eea7d975
+++ b/fuzz/corpus/816d80c9d39a049a07896564097d46a0eea7d975
+F7e3___d
--- a/fuzz/corpus/849b4539bcdfc28a21a12a661e0d7b2a962b6bbd-1
+++ b/fuzz/corpus/849b4539bcdfc28a21a12a661e0d7b2a962b6bbd-1
+I_
--- a/fuzz/corpus/8afa5d7f15fe408a59ef0d97cd8afb5e2597c93c-3
+++ b/fuzz/corpus/8afa5d7f15fe408a59ef0d97cd8afb5e2597c93c-3
--- a/fuzz/corpus/8e2ad525d4146a6960c4537e503360002a293956-3
+++ b/fuzz/corpus/8e2ad525d4146a6960c4537e503360002a293956-3
+((l(dS''
+(lQsal.
\ No newline at end of file
--- a/fuzz/corpus/93acbc9575a562b62b64638700b38e44bae72670-4
+++ b/fuzz/corpus/93acbc9575a562b62b64638700b38e44bae72670-4
+F0_0_0_0_0_0_0_0__
--- a/fuzz/corpus/95f7e42660537d5d29347d70f52f4f9175268407-4
+++ b/fuzz/corpus/95f7e42660537d5d29347d70f52f4f9175268407-4
+F7e3_________
--- a/fuzz/corpus/98abc954a27f40059443f5b9a4cf77f9ad1163dd-1
+++ b/fuzz/corpus/98abc954a27f40059443f5b9a4cf77f9ad1163dd-1
--- a/fuzz/corpus/ab733544dbb1c42ccc9dbc10228798ea030fb4bb-3
+++ b/fuzz/corpus/ab733544dbb1c42ccc9dbc10228798ea030fb4bb-3
+F0x
--- a/fuzz/corpus/ae4f281df5a5d0ff3cad6371f76d5c29b6d953ec-1
+++ b/fuzz/corpus/ae4f281df5a5d0ff3cad6371f76d5c29b6d953ec-1
+B
\ No newline at end of file
--- a/fuzz/corpus/aed03f34d6c06bf37b20a474e1370e8cfbc2d801-1
+++ b/fuzz/corpus/aed03f34d6c06bf37b20a474e1370e8cfbc2d801-1
--- a/fuzz/corpus/b3c2c74168b15db955bbd036572722ec3f153d28-1
+++ b/fuzz/corpus/b3c2c74168b15db955bbd036572722ec3f153d28-1
+c__builtin__
+bytearray
+(c
+
+(ttR.
\ No newline at end of file
--- a/fuzz/corpus/b4e4e07ff0b9eaec6c15237718d54a2aa3f4cbc6
+++ b/fuzz/corpus/b4e4e07ff0b9eaec6c15237718d54a2aa3f4cbc6
+}(UaU1U2u.
\ No newline at end of file
--- a/fuzz/corpus/b523a572216d123644fffa237f931a0d8d1662f6-1
+++ b/fuzz/corpus/b523a572216d123644fffa237f931a0d8d1662f6-1
+F0_n
--- a/fuzz/corpus/b5a972d2bc35c8818ca23e6e17f5eb1cb4ace8ae
+++ b/fuzz/corpus/b5a972d2bc35c8818ca23e6e17f5eb1cb4ace8ae
+S"\n\r\xe2\x80\xa8\u\U"
+.
\ No newline at end of file
--- a/fuzz/corpus/b5ad7322357b766f6ebdeac167d2e7d1bdbfe916-2
+++ b/fuzz/corpus/b5ad7322357b766f6ebdeac167d2e7d1bdbfe916-2
--- a/fuzz/corpus/b63806dbe0c51cf773b3d564410761b37aa5fd0d-1
+++ b/fuzz/corpus/b63806dbe0c51cf773b3d564410761b37aa5fd0d-1
+V\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--- a/fuzz/corpus/b8f3eec6b5fa270fb05644de403d9077b60ccbcf-1
+++ b/fuzz/corpus/b8f3eec6b5fa270fb05644de403d9077b60ccbcf-1
+–
\ No newline at end of file
--- a/fuzz/corpus/ba52c29b96f28033fd4bfb32ffc42a96edb9688e-4
+++ b/fuzz/corpus/ba52c29b96f28033fd4bfb32ffc42a96edb9688e-4
+F519659175926385_0_0o
--- a/fuzz/corpus/bac4c4dfadcc19cb8ad74521aebf48939213e5ee-1
+++ b/fuzz/corpus/bac4c4dfadcc19cb8ad74521aebf48939213e5ee-1
+}(C2u.
\ No newline at end of file
--- a/fuzz/corpus/bbe0dfd48edbb7a85b7934c3a0c21736b8d2f0b7-4
+++ b/fuzz/corpus/bbe0dfd48edbb7a85b7934c3a0c21736b8d2f0b7-4
+F02384185791015625_0
+F3_
--- a/fuzz/corpus/c0d9f3333e250abaf6ba971fb487f74beb8cd126
+++ b/fuzz/corpus/c0d9f3333e250abaf6ba971fb487f74beb8cd126
+V\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--- a/fuzz/corpus/c7d2aaba82ac8309a0e59804ca7fb96315cc26f2
+++ b/fuzz/corpus/c7d2aaba82ac8309a0e59804ca7fb96315cc26f2
+c
+
+UbingR.
\ No newline at end of file
--- a/fuzz/corpus/cefb7c57827c894e336df0255b9e5b4ce3f57b62-3
+++ b/fuzz/corpus/cefb7c57827c894e336df0255b9e5b4ce3f57b62-3
--- a/fuzz/corpus/d0ba017a77bb7a1740c07f1f0d7dff92fdf69c39-2
+++ b/fuzz/corpus/d0ba017a77bb7a1740c07f1f0d7dff92fdf69c39-2
+F0E0__
--- a/fuzz/corpus/d0d9a61ee0368f5586d04fd50bc241dbc4a749ab-1
+++ b/fuzz/corpus/d0d9a61ee0368f5586d04fd50bc241dbc4a749ab-1
+c__builtin__
+bytearray
+(Utin1tRtR
\ No newline at end of file
--- a/fuzz/corpus/d11388dfe042a6ae94e162d32f0602fd7b7f83dc-1
+++ b/fuzz/corpus/d11388dfe042a6ae94e162d32f0602fd7b7f83dc-1
+}(UaU1U2u.
\ No newline at end of file
--- a/fuzz/corpus/d14da823856076f085d7e9006e6b4dab7464ca1b-4
+++ b/fuzz/corpus/d14da823856076f085d7e9006e6b4dab7464ca1b-4
--- a/fuzz/corpus/db115ce5c7ba4e7fe8f6c204c1127edda5650b7f-3
+++ b/fuzz/corpus/db115ce5c7ba4e7fe8f6c204c1127edda5650b7f-3
+F0_.
--- a/fuzz/corpus/db54136ebbd8435683a599b1b55c749727c0db3c-1
+++ b/fuzz/corpus/db54136ebbd8435683a599b1b55c749727c0db3c-1
+c_codecs
+encode
+XÑUQQQQQQQQR.
\ No newline at end of file
--- a/fuzz/corpus/dd63ba5c92040b0cc51f6b67c7bb69d2bb3d7035-1
+++ b/fuzz/corpus/dd63ba5c92040b0cc51f6b67c7bb69d2bb3d7035-1
--- a/fuzz/corpus/de8c9628e5094a0e9db8ff440873541a543a683d-1
+++ b/fuzz/corpus/de8c9628e5094a0e9db8ff440873541a543a683d-1
+F7e3______d
--- a/fuzz/corpus/f11b62953715796a41e01f27f5f51988a636c4d2-1
+++ b/fuzz/corpus/f11b62953715796a41e01f27f5f51988a636c4d2-1
--- a/fuzz/corpus/f2a7a881ea7127561610b69eb17215d2d050017b-3
+++ b/fuzz/corpus/f2a7a881ea7127561610b69eb17215d2d050017b-3
+F0_0_0_0__
--- a/fuzz/corpus/f46a5feaae57492e235a05b729ab5b859a223e1e-1
+++ b/fuzz/corpus/f46a5feaae57492e235a05b729ab5b859a223e1e-1
+Finfi
--- a/fuzz/corpus/f4cba62107a085e4753268e261e4da21918e5629
+++ b/fuzz/corpus/f4cba62107a085e4753268e261e4da21918e5629
+(lp
+.
\ No newline at end of file
--- a/fuzz/corpus/f79124bb7d5206059db6748cba8d64f335e04bcb
+++ b/fuzz/corpus/f79124bb7d5206059db6748cba8d64f335e04bcb
+c_codecs
+encode
+X¸Ã‘ÂUlatin1†R.
\ No newline at end of file
--- a/fuzz/corpus/f977929df9b5115317e6cace3409f9d36ee6f4a8-4
+++ b/fuzz/corpus/f977929df9b5115317e6cace3409f9d36ee6f4a8-4
+F0_0
+F3_0_0
+F0_0
+F3__
--- a/fuzz/corpus/fa138ae356d35c8d77083c406a5be73745643aae-1
+++ b/fuzz/corpus/fa138ae356d35c8d77083c406a5be73745643aae-1
+—
\ No newline at end of file
--- a/fuzz/corpus/fa5e2b9eeece037051f8b16ce8ad578901671154-2
+++ b/fuzz/corpus/fa5e2b9eeece037051f8b16ce8ad578901671154-2
--- a/fuzz/corpus/fad1d13856893f14a0657f1f1ee97184c6e37960-1
+++ b/fuzz/corpus/fad1d13856893f14a0657f1f1ee97184c6e37960-1
+c_codecs
+encode
+X¸Ã‘ÂClatin1†R.
\ No newline at end of file
--- a/fuzz/corpus/fd0d14c69dee12e9c5d2db9b19e27c063c5712e2-11
+++ b/fuzz/corpus/fd0d14c69dee12e9c5d2db9b19e27c063c5712e2-11
--- a/fuzz/corpus/ff318f2bec5a87f89279884b56445580d0d53061-1
+++ b/fuzz/corpus/ff318f2bec5a87f89279884b56445580d0d53061-1
+F7e2"
--- a/ogorek.go
+++ b/ogorek.go
@@ -781,11 +781,12 @@ func (d *Decoder) bufLoadBinData8() error {
 func (d *Decoder) bufLoadBytesData(l uint64) error {
 	d.buf.Reset()
 	// don't allow malicious `BINSTRING <bigsize> nodata` to make us out of memory
-	prealloc := int(l)
-	if maxgrow := 0x10000; prealloc > maxgrow {
+	prealloc := l
+	const maxgrow = 0x10000
+	if prealloc > maxgrow {
 		prealloc = maxgrow
 	}
-	d.buf.Grow(prealloc)
+	d.buf.Grow(int(prealloc))
 	if l > math.MaxInt64 {
 		return fmt.Errorf("size([]data) > maxint64")
 	}

--- a/ogorek_test.go
+++ b/ogorek_test.go
@@ -842,6 +842,7 @@ func TestFuzzCrashers(t *testing.T) {
 		"(]QNd.",          // PersID([])      -> dict
 		"}]QNs.",          // PersID([])      -> setitem
 		"}(]QNI1\nNu.",    // PersID([]) ...  -> setitems
+		"\x960000000\xef", // BYTEARRAY8
 	}

 	for _, c := range crashers {