Skip to content

fix(size): avoid u64 overflow panic when parsing huge size args#1981

Closed
Bojun-Vvibe wants to merge 1 commit intosharkdp:masterfrom
Bojun-Vvibe:agent/sharkdp_fd-1776715641
Closed

fix(size): avoid u64 overflow panic when parsing huge size args#1981
Bojun-Vvibe wants to merge 1 commit intosharkdp:masterfrom
Bojun-Vvibe:agent/sharkdp_fd-1776715641

Conversation

@Bojun-Vvibe
Copy link
Copy Markdown

Repo: sharkdp/fd (⭐ 36000)
Type: bugfix
Files changed: 1
Lines: +3/-1

What

SizeFilter::parse_opt in src/filter/size.rs multiplied the parsed quantity
by its unit multiplier using plain *. For values such as +20000000T or
+17000000Ti, that product overflows u64 and panics in debug builds (and
wraps silently in release). This change replaces the multiplication with
checked_mul(...)?, making overflow cause the parser to return None — which
bubbles up as the normal "not a valid size constraint" error from the CLI.
Two regression tests are added alongside the existing failure cases.

Why

A user-supplied CLI argument should never be able to crash fd or silently be
misinterpreted. The existing parser validates format via regex but does not
guard against numeric overflow of the final computed byte count. With this
fix, fd --size +20000000T produces a clean error message instead of an
arithmetic overflow panic / wrapped value.

Testing

  • cargo test --bin fd size:: — 86 passed, 0 failed, including the two new
    ensure_overflow_returns_none_* cases.
  • Before the fix, the new tests panic under cargo test (overflow); after,
    they pass.

Risk

Low — change is a two-character semantic tweak confined to the size parser,
covered by pre-existing and new unit tests. No behavior change for valid
inputs.

Parsing size arguments like '+20000000T' used to panic due to
unchecked multiplication of quantity by the unit multiplier. Use
checked_mul so invalid (too-large) inputs are rejected as an error
from the CLI instead of aborting the process.
@Bojun-Vvibe Bojun-Vvibe closed this by deleting the head repository Apr 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant