Merge pull request #2012 from asvetlik/iss#2005

Added a test code to test the fuzzer bugs and fixed 2 of the bugs found in roaring

roaring/fuzz_test.go

@@ -0,0 +1,44 @@
+// Copyright 2017 Pilosa Corp.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package roaring
+
+import ( 
+	"testing"
+)
+
+func TestUnmarshalBinary(t *testing.T) {
+	b := NewBitmap()
+	confirmedCrashers := []struct {
+		cr []byte
+		expected string
+	} {
+		{
+			cr : []byte(":0\x000\x01\x00\x00\x000000"),					//":000000"
+			expected : "reading roaring header: malformed bitmap, key-cardinality slice overruns buffer at 12",
+		},				
+		{
+			cr : []byte("<0\x000\x00\x00\x00\x00000000000000" +
+			"0"),														//"<000000000000000"
+			expected : "unmarshaling as pilosa roaring: Maximum operation size exceeded",
+		},		
+	}
+
+	for _, crash := range confirmedCrashers {
+		err := b.UnmarshalBinary(crash.cr)
+		if err.Error() != crash.expected {
+			t.Errorf("Expected: %s, Got: %s", crash.expected, err)
+		} 
+	}
+	
+}

roaring/roaring.go

@@ -3951,6 +3951,7 @@ func (op *op) WriteTo(w io.Writer) (n int64, err error) {
 }
 
 var minOpSize = 13
+var maxBatchSize = uint64(1<<59)
 
 // UnmarshalBinary decodes data into an op.
 func (op *op) UnmarshalBinary(data []byte) error {
@@ -3968,6 +3969,11 @@ func (op *op) UnmarshalBinary(data []byte) error {
 	_, _ = h.Write(data[0:9])
 
 	if op.typ > 1 {
+		// This ensures that in doing 13+op.value*8, the max int won't be exceeded and a wrap around case
+		// (resulting in a negative value) won't occur in the slice indexing while writing
+		if op.value > maxBatchSize {
+			return fmt.Errorf("Maximum operation size exceeded")
+		}
 		if len(data) < int(13+op.value*8) {
 			return fmt.Errorf("op data truncated - expected %d, got %d", 13+op.value*8, len(data))
 		}
@@ -4460,7 +4466,7 @@ func readOfficialHeader(buf []byte) (size uint32, containerTyper func(index uint
 	}
 
 	// descriptive header
-	if pos+2*2*int(size) > len(buf) {
+	if pos+2*2*int(size) >= len(buf) {
 		err = fmt.Errorf("malformed bitmap, key-cardinality slice overruns buffer at %d", pos+2*2*int(size))
 		return size, containerTyper, header, pos, flags, haveRuns, err
 	}