Skip to content

u64->usize overflow in h1 decode on 32bit system  #4055

@cpud36

Description

@cpud36

The code in question:

let to_read = *remaining as usize;
let buf = ready!(body.read_mem(cx, to_read))?;
let num = buf.as_ref().len() as u64;

Here, if it ever happens that *remaining is divisible by usize::MAX, to_read will become 0 and the code will return an error IncompleteBody, which is clearly wrong.

Moreover, even in cases when remaining is not exactly divisible by usize::MAX, but has small remainder, this is suboptimal (and likely to produce remainder divisible by usize::MAX).

Maybe it is worth to replace this with saturating cast?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions