From a0441c7ae3dea57a0553c9ea77e184c34b7da40f Mon Sep 17 00:00:00 2001 From: Ian Lance Taylor Date: Thu, 22 Sep 2022 21:17:05 -0700 Subject: encoding/gob: use saferio.SliceCap when decoding a slice MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This avoids allocating an overly large slice for corrupt input. Change the saferio.SliceCap function to take a pointer to the element type, so that we can handle slices of interface types. This revealed that a couple of existing calls were actually incorrect, passing the slice type rather than the element type. No test case because the problem can only happen for invalid data. Let the fuzzer find cases like this. Fixes #55338 Change-Id: I3c1724183cc275d4981379773b0b8faa01a9cbd2 Reviewed-on: https://go-review.googlesource.com/c/go/+/433296 Reviewed-by: Ian Lance Taylor Reviewed-by: Daniel Martí Reviewed-by: Cherry Mui TryBot-Result: Gopher Robot Run-TryBot: Ian Lance Taylor Auto-Submit: Ian Lance Taylor --- src/encoding/gob/decode.go | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) (limited to 'src/encoding') diff --git a/src/encoding/gob/decode.go b/src/encoding/gob/decode.go index 470e357b10..480832ca4f 100644 --- a/src/encoding/gob/decode.go +++ b/src/encoding/gob/decode.go @@ -9,6 +9,7 @@ package gob import ( "encoding" "errors" + "internal/saferio" "io" "math" "math/bits" @@ -514,10 +515,22 @@ func (dec *Decoder) decodeArrayHelper(state *decoderState, value reflect.Value, } instr := &decInstr{elemOp, 0, nil, ovfl} isPtr := value.Type().Elem().Kind() == reflect.Pointer + ln := value.Len() for i := 0; i < length; i++ { if state.b.Len() == 0 { errorf("decoding array or slice: length exceeds input size (%d elements)", length) } + if i >= ln { + // This is a slice that we only partially allocated. + // Grow it using append, up to length. + value = reflect.Append(value, reflect.Zero(value.Type().Elem())) + cp := value.Cap() + if cp > length { + cp = length + } + value.SetLen(cp) + ln = cp + } v := value.Index(i) if isPtr { v = decAlloc(v) @@ -618,7 +631,11 @@ func (dec *Decoder) decodeSlice(state *decoderState, value reflect.Value, elemOp errorf("%s slice too big: %d elements of %d bytes", typ.Elem(), u, size) } if value.Cap() < n { - value.Set(reflect.MakeSlice(typ, n, n)) + safe := saferio.SliceCap(reflect.Zero(reflect.PtrTo(typ.Elem())).Interface(), uint64(n)) + if safe < 0 { + errorf("%s slice too big: %d elements of %d bytes", typ.Elem(), u, size) + } + value.Set(reflect.MakeSlice(typ, safe, safe)) } else { value.SetLen(n) } -- cgit v1.3-5-g9baa