Skip to content

lisafs: Use uint64 for the NumBytes bounds check in PReadResp.CheckedUnmarshal. - #14464

Open
arcusbuilds wants to merge 1 commit into
google:masterfrom
arcusbuilds:master
Open

lisafs: Use uint64 for the NumBytes bounds check in PReadResp.CheckedUnmarshal.#14464
arcusbuilds wants to merge 1 commit into
google:masterfrom
arcusbuilds:master

Conversation

@arcusbuilds

Copy link
Copy Markdown

This fixes a panic in lisafs when a malformed PReadResp frame contains a NumBytes value with high bits set.

The root cause was a bounds check that compared NumBytes after truncating it to uint32, while the later slice used the full uint64 value. That allowed invalid lengths to pass validation and triggered a slice-bounds panic.

Fixes #14424

@google-cla

google-cla Bot commented Aug 27, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@elassasmohamed8-prog

Copy link
Copy Markdown

Confirmed this addresses the root cause reported in #14424 exactly: the uint32-truncated comparison admitted values like 0x0000000C00000000 (truncates to 0) while the subsequent slice used the full uint64.

For regression coverage, this minimal test reproduces the panic on the pre-fix tree and passes with this change (both verified on a local build):

func TestReproPReadRespNumBytesTruncation(t *testing.T) {
	in := []byte("\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
	var m PReadResp
	defer func() {
		if r := recover(); r != nil {
			t.Fatalf("panic: %v", r)
		}
	}()
	m.CheckedUnmarshal(in)
}

Happy to push this as a commit onto this branch if maintainers would like it included.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pkg/lisafs: PReadResp.CheckedUnmarshal panics on malformed NumBytes due to uint32 truncation in bounds check

2 participants