lisafs: Use uint64 for the NumBytes bounds check in PReadResp.CheckedUnmarshal. - #14464
lisafs: Use uint64 for the NumBytes bounds check in PReadResp.CheckedUnmarshal.#14464arcusbuilds wants to merge 1 commit into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
Confirmed this addresses the root cause reported in #14424 exactly: the For regression coverage, this minimal test reproduces the panic on the pre-fix tree and passes with this change (both verified on a local build): func TestReproPReadRespNumBytesTruncation(t *testing.T) {
in := []byte("\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
var m PReadResp
defer func() {
if r := recover(); r != nil {
t.Fatalf("panic: %v", r)
}
}()
m.CheckedUnmarshal(in)
}Happy to push this as a commit onto this branch if maintainers would like it included. |
This fixes a panic in lisafs when a malformed PReadResp frame contains a NumBytes value with high bits set.
The root cause was a bounds check that compared NumBytes after truncating it to uint32, while the later slice used the full uint64 value. That allowed invalid lengths to pass validation and triggered a slice-bounds panic.
Fixes #14424