From 2df44eecfd0d1b66b0c036b5af1a0761d580ee8c Mon Sep 17 00:00:00 2001 From: Ashley Svetlik Date: Wed, 19 Jun 2019 13:38:23 -0500 Subject: [PATCH] Implemented previous fixes not present --- roaring/fuzz_test.go | 2 +- roaring/roaring.go | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/roaring/fuzz_test.go b/roaring/fuzz_test.go index b11d00337..69362d947 100644 --- a/roaring/fuzz_test.go +++ b/roaring/fuzz_test.go @@ -30,7 +30,7 @@ func TestUnmarshalBinary(t *testing.T) { { cr : []byte("<0\x000\x00\x00\x00\x00000000000000" + "0"), //"<000000000000000" - expected : "unmarshaling as pilosa roaring: too big", + expected : "unmarshaling as pilosa roaring: Maximum operation size exceeded", }, } diff --git a/roaring/roaring.go b/roaring/roaring.go index ff16cd5d4..44a0b52e9 100644 --- a/roaring/roaring.go +++ b/roaring/roaring.go @@ -3944,6 +3944,7 @@ func (op *op) WriteTo(w io.Writer) (n int64, err error) { } var minOpSize = 13 +var maxBatchSize = uint64(1<<59) // UnmarshalBinary decodes data into an op. func (op *op) UnmarshalBinary(data []byte) error { @@ -3961,6 +3962,11 @@ func (op *op) UnmarshalBinary(data []byte) error { _, _ = h.Write(data[0:9]) if op.typ > 1 { + // This ensures that in doing 13+op.value*8, the max int won't be exceeded and a wrap around case + // (resulting in a negative value) won't occur in the slice indexing while writing + if op.value > maxBatchSize { + return fmt.Errorf("Maximum operation size exceeded") + } if len(data) < int(13+op.value*8) { return fmt.Errorf("op data truncated - expected %d, got %d", 13+op.value*8, len(data)) }