fixed issue #109

arangodb · Jan 27, 2022 · 94e36ad · 94e36ad
1 parent 3cfdb0b
commit 94e36ad
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 1 deletion.
diff --git a/src/Validator.cpp b/src/Validator.cpp
@@ -259,11 +259,14 @@ void Validator::validateCompactArray(uint8_t const* ptr, std::size_t length) {
     throw Exception(Exception::ValidatorInvalidLength, "Array length value is out of bounds");
   }
   ++p;
-
+  
   // validate the array members
   uint8_t const* e = p;
   p = data;
   while (nrItems-- > 0) {
+    if (p >= e) {
+      throw Exception(Exception::ValidatorInvalidLength, "Array items number is out of bounds");
+    }
     validate(p, e - p, true);
     p += Slice(p).byteSize();
   }

diff --git a/tests/testsValidator.cpp b/tests/testsValidator.cpp
@@ -1830,6 +1830,34 @@ TEST(ValidatorTest, ArrayCompactNrItemsWrong3) {
   ASSERT_VELOCYPACK_EXCEPTION(validator.validate(value.c_str(), value.size()), Exception::ValidatorInvalidLength);
 }
 
+TEST(ValidatorTest, ArrayCompactNrItemsExceedsBytesize) {
+  std::string const value("\x13\x06\x42\x40\x40\x02", 6);
+
+  Validator validator;
+  ASSERT_VELOCYPACK_EXCEPTION(validator.validate(value.c_str(), value.size()), Exception::ValidatorInvalidLength);
+}
+
+TEST(ValidatorTest, ArrayCompactMemberExceedsBytesize1) {
+  std::string const value("\x13\x06\x43\x40\x40\x02", 6);
+
+  Validator validator;
+  ASSERT_VELOCYPACK_EXCEPTION(validator.validate(value.c_str(), value.size()), Exception::ValidatorInvalidLength);
+}
+
+TEST(ValidatorTest, ArrayCompactMemberExceedsBytesize2) {
+  std::string const value("\x13\x06\x44\x40\x40\x02", 6);
+
+  Validator validator;
+  ASSERT_VELOCYPACK_EXCEPTION(validator.validate(value.c_str(), value.size()), Exception::ValidatorInvalidLength);
+}
+
+TEST(ValidatorTest, ArrayCompactMemberExceedsBytesize3) {
+  std::string const value("\x13\x06\x45\x40\x40\x02", 6);
+
+  Validator validator;
+  ASSERT_VELOCYPACK_EXCEPTION(validator.validate(value.c_str(), value.size()), Exception::ValidatorInvalidLength);
+}
+
 TEST(ValidatorTest, ArrayCompactManyEntries) {
   Builder b;
   b.openArray(true);