From eb5d1ae1a4224e5fc9f1ead0ee672fbbfc5ab15f Mon Sep 17 00:00:00 2001
From: Ashley Svetlik <ash.svetlik@gmail.com>
Date: Mon, 24 Jun 2019 12:51:10 -0500
Subject: [PATCH] Fixed malformed offset bug in readWithRuns

---
 roaring/fuzz_test.go |  4 ++++
 roaring/roaring.go   | 11 +++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/roaring/fuzz_test.go b/roaring/fuzz_test.go
index 232ebf2f6..2ecb641de 100644
--- a/roaring/fuzz_test.go
+++ b/roaring/fuzz_test.go
@@ -57,6 +57,10 @@ func TestUnmarshalBinary(t *testing.T) {
 			cr:       []byte("<0\x00\x02\x03\x00\x00\x00쳫\v\x00d9\v\x00\x009\v"), //<0쳫d99
 			expected: "unmarshaling as pilosa roaring: malformed bitmap, key-cardinality not provided for 0 containers",
 		},
+		{ // Checks for incomplete offset in readWithRuns
+			cr:       []byte(";0\x000\v00000"), //";0000000"
+			expected: "reading offsets from official roaring format: offset incomplete: len=10",
+		},
 	}
 
 	for _, crash := range confirmedCrashers {
diff --git a/roaring/roaring.go b/roaring/roaring.go
index b29e9f01f..fb004254e 100644
--- a/roaring/roaring.go
+++ b/roaring/roaring.go
@@ -4510,7 +4510,10 @@ func (b *Bitmap) UnmarshalBinary(data []byte) error {
 
 	// Read container offsets and attach data.
 	if haveRuns {
-		readWithRuns(b, data, pos, keyN)
+		err := readWithRuns(b, data, pos, keyN)
+		if err != nil {
+			return errors.Wrap(err, "reading offsets from official roaring format")
+		}
 	} else {
 		err := readOffsets(b, data, pos, keyN)
 		if err != nil {
@@ -4545,7 +4548,10 @@ func readOffsets(b *Bitmap, data []byte, pos int, keyN uint32) error {
 	return nil
 }
 
-func readWithRuns(b *Bitmap, data []byte, pos int, keyN uint32) {
+func readWithRuns(b *Bitmap, data []byte, pos int, keyN uint32) error {
+	if len(data) < pos+runCountHeaderSize {
+		return fmt.Errorf("offset incomplete: len=%d", len(data))
+	}
 	citer, _ := b.Containers.Iterator(0)
 	for i := 0; i < int(keyN); i++ {
 		citer.Next()
@@ -4568,6 +4574,7 @@ func readWithRuns(b *Bitmap, data []byte, pos int, keyN uint32) {
 			pos += bitmapN * 8
 		}
 	}
+	return nil
 }
 
 // handledIter and handledIters are wrappers around Bitmap Container iterators