Skip to content

fix(storage): add bounds validation in Footer::Parse #2171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jfeng18 wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −1
Open

fix(storage): add bounds validation in Footer::Parse #2171

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/storage/serialization.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,9 +80,16 @@ Footer::Parse(StreamReader& reader) {
}
// no popseek, continue to parse

if (length < 20) {

@LHT129 LHT129 Jun 9, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good ordering: this length < 20 early-return runs before any length - 20 evaluation, so the unsigned subtraction below cannot underflow.

reader.PopSeek();
return nullptr;
}
uint64_t metadata_string_length = 0;
std::vector<char> string_buffer(length);
memcpy(&metadata_string_length, meta_buffer.data() + 8, 8);
if (metadata_string_length > length - 20) {

@LHT129 LHT129 Jun 9, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bounds check is correct. Passing gives metadata_string_length <= length - 20, simultaneously protecting the string read [16, 16+L) and the checksum read [16+L, 20+L) (end <= length). Boundary case L == length-20 correctly allowed, and 16 + metadata_string_length + 4 cannot overflow since it is <= length. Relies on meta_buffer.size() >= length; please confirm meta_buffer is sized to length upstream.

@jfeng18 jfeng18 Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed — meta_buffer is constructed as std::vector<char> meta_buffer(length) at line 72, so meta_buffer.size() == length holds. All subsequent accesses stay within [0, length): the bounds check ensures 16 + metadata_string_length + 4 <= length.

reader.PopSeek();
return nullptr;
}
std::string metadata_string(meta_buffer.data() + 16, metadata_string_length);
uint32_t checksum;
memcpy(&checksum, meta_buffer.data() + 16 + metadata_string_length, 4);
Expand Down