github-repos/leveldb
1
0
Fork 0
mirror of https://github.com/google/leveldb.git synced 2025-04-27 14:10:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

Check for integer overflows involving ReadBlock.

Browse Source
This commit is contained in:
Christopher Jeffrey 2022-06-17 21:06:17 -04:00
parent 4fb146810c
commit be8d520965
No known key found for this signature in database
GPG Key ID: 8962AB9DE6666BBD
3 changed files with 11 additions and 2 deletions

5
table/format.cc
View File

@ -67,6 +67,11 @@ Status ReadBlock(RandomAccessFile* file, const ReadOptions& options,
result->cachable = false;
result->heap_allocated = false;
// Check for overflow.
if (handle.size() > std::numeric_limits<size_t>::max() - kBlockTrailerSize) {
return Status::Corruption("block handle size overflow");
}
// Read the block contents as well as the type/crc footer.
// See table_builder.cc for the code that built this structure.
size_t n = static_cast<size_t>(handle.size());

6
util/env_posix.cc
View File

@ -198,6 +198,10 @@ class PosixRandomAccessFile final : public RandomAccessFile {
Status Read(uint64_t offset, size_t n, Slice* result,
char* scratch) const override {
if (offset > std::numeric_limits<off_t>::max()) {
return PosixError(filename_, EINVAL);
}
int fd = fd_;
if (!has_permanent_fd_) {
fd = ::open(filename_.c_str(), O_RDONLY | kOpenBaseFlags);
@ -258,7 +262,7 @@ class PosixMmapReadableFile final : public RandomAccessFile {
Status Read(uint64_t offset, size_t n, Slice* result,
char* scratch) const override {
if (offset + n > length_) {
if (offset + n < n || offset + n > length_) {
*result = Slice();
return PosixError(filename_, EINVAL);
}

2
util/env_windows.cc
View File

@ -247,7 +247,7 @@ class WindowsMmapReadableFile : public RandomAccessFile {
Status Read(uint64_t offset, size_t n, Slice* result,
char* scratch) const override {
if (offset + n > length_) {
if (offset + n < n || offset + n > length_) {
*result = Slice();
return WindowsError(filename_, ERROR_INVALID_PARAMETER);
}