lisafs: fix uint32 truncation in PReadResp.CheckedUnmarshal bounds check (+ regression test) - #14491
Open
elassasmohamed8-prog wants to merge 1 commit into
Conversation
The NumBytes bounds check truncated to uint32 while the subsequent Buf slice used the full uint64 value. A NumBytes with high bits set (e.g. 0x0000000C00000000) truncates to 0, passes all checks, and panics at r.Buf[:51539607552]. Use full-width comparisons in the guard, and add a regression test reproducing the panic on the pre-fix tree. Fixes google#14424
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #14424
What
The NumBytes bounds check truncated to
uint32while the subsequentBufslice used the fulluint64value.NumBytes = 0x0000000C00000000truncates to 0, passes all checks, and panics atr.Buf[:51539607552].Fix
Use full-width
uint64comparisons in the guard (same correction as #14464, which this independently verifies).Extra: regression test
Includes
TestReproPReadRespNumBytesTruncation— reproduces the panic on the pre-fix tree (confirmed locally) and passes with this change. Original root-cause analysis, suggested fix, and this verification are from #14424 (issue author).Both directions verified on a local Bazel build of this tree.