Commit bd5a7fd4 authored by Kirill Smelkov's avatar Kirill Smelkov Committed by Kamil Kisiel

decoder: Fix BININT decoding for negative values

Found via fuzzing:

	"I-7\n."

	panic: protocol 1: decode·encode != identity:
	have: 4294967289
	want: -7

	goroutine 1 [running]:
	github.com/kisielk/og-rek.Fuzz(0x7f99bd8b4000, 0x5, 0x200000, 0x3)
	        /tmp/go-fuzz-build914098789/gopath/src/github.com/kisielk/og-rek/fuzz.go:50 +0x604
	go-fuzz-dep.Main(0x524df8)
	        /tmp/go-fuzz-build914098789/goroot/src/go-fuzz-dep/main.go:49 +0xad
	main.main()
	        /tmp/go-fuzz-build914098789/gopath/src/github.com/kisielk/og-rek/go.fuzz.main/main.go:10 +0x2d
	exit status 2

I've checked other handlers, like BININT1 and BININT2, and since there
everywhere argument is unsigned, there is no similar problem.

We needed previous patch on proper readLine EOF detection, because else
the testcase for P0("I-7\n.") would be breaking:

    --- FAIL: TestDecode/int(-7)/"I-7\n." (0.00s)
        ogorek_test.go:401: no ErrUnexpectedEOF on [:2] truncated stream: v = <nil>  err = &strconv.NumError{Func:"ParseInt", Num:"-", Err:(*errors.errorString)(0xc00000e1b0)}
parent 57137139
......@@ -483,7 +483,7 @@ func (d *Decoder) loadBinInt() error {
return err
}
v := binary.LittleEndian.Uint32(b[:])
d.push(int64(v))
d.push(int64(int32(v))) // NOTE signed: uint32 -> int32, and only then -> int64
return nil
}
......
......@@ -174,6 +174,10 @@ var tests = []TestEntry{
P0("I74565\n."), // INT
P1_("J\x45\x23\x01\x00.")), // BININT
X("int(-7)", int64(-7),
P0("I-7\n."), // INT
P1_("J\xf9\xff\xff\xff.")), // BININT
X("float", float64(1.23),
P0("F1.23\n."), // FLOAT
P1_("G?\xf3\xae\x14z\xe1G\xae.")), // BINFLOAT
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment