Potential index out of bounds in quantity_proto.go

[chunklhit]

What happened?

During fuzz testing of Kubernetes, I discovered a crash, which I believe might be an issue. this issue is in the code located at kubernetes/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go on lines 239, 255, 266, and 270.

Code Snippet

The value of index may potentially exceed the boundaries of the int type, becoming a negative value. However, there is no non-negative check in the code, and it is directly used on line 255. This may result in an out-of-bounds access error.

Comparing the skipGenerated method with others, such as in kubernetes/staging/src/k8s.io/api/apps/v1/generated.pb.go, it can be seen that they validate and handle the index accordingly.

This issue could potentially lead to program crashes and misbehavior in other locations.

Please investigate and address the issue.

What did you expect to happen?

I expect to validate and handle the “iNdEx” value to prevent program crashes.

How can we reproduce it (as minimally and precisely as possible)?

I attempted to trigger the issue using a unit test, with the following code:

package fuzzing

import (
	"fmt"
	"testing"
)
import autoscalingv2 "k8s.io/api/autoscaling/v2"

func TestMetricValueStatus(t *testing.T) {
	m1 := &autoscalingv2.MetricValueStatus{}
	data := []byte("\xbf\n@000000S\x98000000000" +
		"00000000000000000000" +
		"00000s000\x800\x1a\xff\xff\xff\xff\xff\xff\xff\xff" +
		"\xff000000")

	//data := []byte("qwe123qwe123qwe123qwe1231q2ew123qwe123qwe123qwe1231q2qweqwe")
	op := int(data[0])
	fmt.Printf("option is %d\n", op%noOfTargets)
	fmt.Printf("buff is %x\n", data[1:])
	err := m1.Unmarshal(data[1:])
	if err != nil {
		fmt.Println("error is ", err)

		return
	}
}

Running the above unit test results in a crash and throws an exception：

If using "data := []byte("qwe123qwe123qwe123qwe1231q2ew123qwe123qwe123qwe1231q2qweqwe")", it returns a reasonable error output：

Anything else we need to know?

No response

Kubernetes version

code version is release-1.26 or master

Cloud provider

im using kubernetes in my local pc with one master node and three workers configured with kubeadm

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)

[AxeZhan]

You can assign yourself and create a pr for this if you like.

[chunklhit]

ok, I will try to create a pr

[cici37]

/triage accepted

[neolit123]

/sig api-machinery

[k8s-triage-robot]

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

• Confirm that this issue is still relevant with /triage accepted (org members only)
• Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted