Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bytes: unchecked overflow in (*Buffer).tryGrowByReslice #21481

Closed
bcmills opened this issue Aug 16, 2017 · 1 comment
Closed

bytes: unchecked overflow in (*Buffer).tryGrowByReslice #21481

bcmills opened this issue Aug 16, 2017 · 1 comment

Comments

@bcmills
Copy link
Contributor

bcmills commented Aug 16, 2017

The documentation for (*bytes.Buffer).Grow says "If the buffer can't grow it will panic with ErrTooLarge."

However, the calculation of the new size in tryGrowByReslice has an unchecked overflow:

func (b *Buffer) tryGrowByReslice(n int) (int, bool) {
	if l := len(b.buf); l+n <= cap(b.buf) {
		b.buf = b.buf[:l+n]
		return l, true
	}
	return 0, false
}

When n is very large, l+n is negative and passes the cap check.

That results in an attempt to reslice with a negative capacity, panicking with runtime error: slice bounds out of range instead of the promised bytes.ErrTooLarge (https://play.golang.org/p/iwtlQtSehu).

(#19624 would report the erroneous overflow more directly.)

@gopherbot
Copy link

Change https://golang.org/cl/56230 mentions this issue: bytes: avoid overflow in (*Buffer).Grow and ReadFrom

@golang golang locked and limited conversation to collaborators Aug 16, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants