Repository navigation
br: ParseFrom func may overflow due to byte length overflow #63663
Description
for len(data) > 0 {
switch data[0] {
case flagShortValuePrefix:
vlen := data[1]
if len(data[2:]) < int(vlen) {
return errors.Annotatef(berrors.ErrInvalidArgument,
"the length of short value is invalid, vlen: %v", int(vlen))
}
v.shortValue = data[2 : vlen+2]
data = data[vlen+2:]vlen is a length flag, which only support 0-255. If vlen itself is 255, then vlen+2 would overflow.
We should transform it to a larger form to prevent the risk.
Activity
br: Use int for vlen to prevent overflow (#63662)
br: Use int for vlen to prevent overflow (#63662) (#63676)
br: cp overflow fix (#63717)