From eb5d1ae1a4224e5fc9f1ead0ee672fbbfc5ab15f Mon Sep 17 00:00:00 2001
From: Ashley Svetlik <ash.svetlik@gmail.com>
Date: Mon, 24 Jun 2019 12:51:10 -0500
Subject: [PATCH 1/3] Fixed malformed offset bug in readWithRuns

---
 roaring/fuzz_test.go |  4 ++++
 roaring/roaring.go   | 11 +++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/roaring/fuzz_test.go b/roaring/fuzz_test.go
index 232ebf2f6..2ecb641de 100644
--- a/roaring/fuzz_test.go
+++ b/roaring/fuzz_test.go
@@ -57,6 +57,10 @@ func TestUnmarshalBinary(t *testing.T) {
 			cr:       []byte("<0\x00\x02\x03\x00\x00\x00쳫\v\x00d9\v\x00\x009\v"), //<0쳫d99
 			expected: "unmarshaling as pilosa roaring: malformed bitmap, key-cardinality not provided for 0 containers",
 		},
+		{ // Checks for incomplete offset in readWithRuns
+			cr:       []byte(";0\x000\v00000"), //";0000000"
+			expected: "reading offsets from official roaring format: offset incomplete: len=10",
+		},
 	}
 
 	for _, crash := range confirmedCrashers {
diff --git a/roaring/roaring.go b/roaring/roaring.go
index b29e9f01f..fb004254e 100644
--- a/roaring/roaring.go
+++ b/roaring/roaring.go
@@ -4510,7 +4510,10 @@ func (b *Bitmap) UnmarshalBinary(data []byte) error {
 
 	// Read container offsets and attach data.
 	if haveRuns {
-		readWithRuns(b, data, pos, keyN)
+		err := readWithRuns(b, data, pos, keyN)
+		if err != nil {
+			return errors.Wrap(err, "reading offsets from official roaring format")
+		}
 	} else {
 		err := readOffsets(b, data, pos, keyN)
 		if err != nil {
@@ -4545,7 +4548,10 @@ func readOffsets(b *Bitmap, data []byte, pos int, keyN uint32) error {
 	return nil
 }
 
-func readWithRuns(b *Bitmap, data []byte, pos int, keyN uint32) {
+func readWithRuns(b *Bitmap, data []byte, pos int, keyN uint32) error {
+	if len(data) < pos+runCountHeaderSize {
+		return fmt.Errorf("offset incomplete: len=%d", len(data))
+	}
 	citer, _ := b.Containers.Iterator(0)
 	for i := 0; i < int(keyN); i++ {
 		citer.Next()
@@ -4568,6 +4574,7 @@ func readWithRuns(b *Bitmap, data []byte, pos int, keyN uint32) {
 			pos += bitmapN * 8
 		}
 	}
+	return nil
 }
 
 // handledIter and handledIters are wrappers around Bitmap Container iterators

From 55aa864cac9b740fe6118f207b9ea2544b75387f Mon Sep 17 00:00:00 2001
From: Ashley Svetlik <ash.svetlik@gmail.com>
Date: Mon, 24 Jun 2019 12:55:32 -0500
Subject: [PATCH 2/3] Fixed malformed offset bug in readOffsets

---
 roaring/fuzz_test.go | 5 +++++
 roaring/roaring.go   | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/roaring/fuzz_test.go b/roaring/fuzz_test.go
index 2ecb641de..e56d3f0ce 100644
--- a/roaring/fuzz_test.go
+++ b/roaring/fuzz_test.go
@@ -61,6 +61,11 @@ func TestUnmarshalBinary(t *testing.T) {
 			cr:       []byte(";0\x000\v00000"), //";0000000"
 			expected: "reading offsets from official roaring format: offset incomplete: len=10",
 		},
+		{ // Checks for incomplete offset in readOffsets
+			cr: []byte(":0\x000\x03\x00\x00\x00000000000000" +
+				"\x00"), //:0000000000000
+			expected: "reading offsets from official roaring format: offset incomplete: len=1",
+		},
 	}
 
 	for _, crash := range confirmedCrashers {
diff --git a/roaring/roaring.go b/roaring/roaring.go
index fb004254e..b59900ec1 100644
--- a/roaring/roaring.go
+++ b/roaring/roaring.go
@@ -4527,6 +4527,10 @@ func readOffsets(b *Bitmap, data []byte, pos int, keyN uint32) error {
 
 	citer, _ := b.Containers.Iterator(0)
 	for i, buf := 0, data[pos:]; i < int(keyN); i, buf = i+1, buf[4:] {
+		// Verify the offset is fully formed
+		if len(buf) < 4 {
+			return fmt.Errorf("offset incomplete: len=%d", len(buf))
+		}
 		offset := binary.LittleEndian.Uint32(buf[0:4])
 		// Verify the offset is within the bounds of the input data.
 		if int(offset) >= len(data) {

From 3a96315a289231b4dee322fcddb46d56da384045 Mon Sep 17 00:00:00 2001
From: asvetlik <50917358+asvetlik@users.noreply.github.com>
Date: Mon, 24 Jun 2019 12:59:31 -0500
Subject: [PATCH 3/3] Revert "Merge pull request #2017 from asvetlik/master"