Afonsojanu fix/ext32 uint32 max length overflow - #1185
Merged
redboltz merged 3 commits intoSep 5, 2026
Merged
Conversation
The C unpacker's internal "trail" bookkeeping combines an ext value's type byte with its data into a single byte count by adding 1 to the length read off the wire. For ext8/ext16 that addition stays well inside a 32-bit range, but ext32's length field can legitimately be the full UINT32_MAX, and tmp + 1 done in 32-bit arithmetic wraps around to 0. The parser then treats the object as a zero-length ext and immediately errors out through template_callback_ext's l == 0 check, so any ext exactly at the wire format's own maximum size fails to unpack with MSGPACK_UNPACK_PARSE_ERROR even though it's a perfectly valid encoding. Widened the trail field (and the str/bin/ext callback length parameter that ends up receiving it) from unsigned int to size_t, and cast the ext32 length to size_t before adding 1 so the addition itself doesn't wrap on a 64-bit build. On a 32-bit build the same edge case is still out of reach, but that matches the existing intentional limitation on the C++ side and a 32-bit process can't address a buffer that size anyway. Added a regression test that packs and unpacks an ext with exactly UINT32_MAX bytes of data; it skips itself if the host can't spare the roughly 8GB of memory the test needs rather than failing outright. Fixes msgpack#1086
- Build the test only for 64-bit targets (#if SIZE_MAX > UINT32_MAX): gcc -m32 -Werror rejects calloc/memcmp with UINT32_MAX, and ASan on 32-bit aborts on the allocation instead of returning NULL. - Replace GTEST_SKIP() with return, since the coverage job builds against googletest 1.7.0 which does not provide it.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## c_master #1185 +/- ##
============================================
+ Coverage 55.35% 57.47% +2.11%
============================================
Files 10 10
Lines 1120 1124 +4
Branches 127 129 +2
============================================
+ Hits 620 646 +26
+ Misses 500 478 -22 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.