Skip to content

Commit 7d99463

Browse files
committed
Replaced integer overflow with efficient way.
Same fix as msgpack#776 on C.
1 parent 29b9505 commit 7d99463

File tree

2 files changed

+24
-12
lines changed

2 files changed

+24
-12
lines changed

include/msgpack/v1/unpack.hpp

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -113,10 +113,13 @@ struct unpack_array {
113113
if (n > u.limit().array()) throw msgpack::array_size_overflow("array size overflow");
114114
o.type = msgpack::type::ARRAY;
115115
o.via.array.size = 0;
116-
size_t size = n*sizeof(msgpack::object);
117-
if (size / sizeof(msgpack::object) != n) {
116+
117+
#if SIZE_MAX == UINT_MAX
118+
if (n > SIZE_MAX/sizeof(msgpack::object))
118119
throw msgpack::array_size_overflow("array size overflow");
119-
}
120+
#endif // SIZE_MAX == UINT_MAX
121+
122+
size_t size = n*sizeof(msgpack::object);
120123
o.via.array.ptr = static_cast<msgpack::object*>(u.zone().allocate_align(size, MSGPACK_ZONE_ALIGNOF(msgpack::object)));
121124
}
122125
};
@@ -125,6 +128,7 @@ inline void unpack_array_item(msgpack::object& c, msgpack::object const& o)
125128
{
126129
#if defined(__GNUC__) && !defined(__clang__)
127130
std::memcpy(&c.via.array.ptr[c.via.array.size++], &o, sizeof(msgpack::object));
131+
128132
#else /* __GNUC__ && !__clang__ */
129133
c.via.array.ptr[c.via.array.size++] = o;
130134
#endif /* __GNUC__ && !__clang__ */
@@ -135,10 +139,13 @@ struct unpack_map {
135139
if (n > u.limit().map()) throw msgpack::map_size_overflow("map size overflow");
136140
o.type = msgpack::type::MAP;
137141
o.via.map.size = 0;
138-
size_t size = n*sizeof(msgpack::object_kv);
139-
if (size / sizeof(msgpack::object_kv) != n) {
142+
143+
#if SIZE_MAX == UINT_MAX
144+
if (n > SIZE_MAX/sizeof(msgpack::object_kv))
140145
throw msgpack::map_size_overflow("map size overflow");
141-
}
146+
#endif // SIZE_MAX == UINT_MAX
147+
148+
size_t size = n*sizeof(msgpack::object_kv);
142149
o.via.map.ptr = static_cast<msgpack::object_kv*>(u.zone().allocate_align(size, MSGPACK_ZONE_ALIGNOF(msgpack::object_kv)));
143150
}
144151
};

include/msgpack/v2/create_object_visitor.hpp

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -163,10 +163,13 @@ class create_object_visitor : public msgpack::v2::null_visitor {
163163
obj->via.array.ptr = MSGPACK_NULLPTR;
164164
}
165165
else {
166-
size_t size = num_elements*sizeof(msgpack::object);
167-
if (size / sizeof(msgpack::object) != num_elements) {
166+
167+
#if SIZE_MAX == UINT_MAX
168+
if (num_elements > SIZE_MAX/sizeof(msgpack::object))
168169
throw msgpack::array_size_overflow("array size overflow");
169-
}
170+
#endif // SIZE_MAX == UINT_MAX
171+
172+
size_t size = num_elements*sizeof(msgpack::object);
170173
obj->via.array.ptr =
171174
static_cast<msgpack::object*>(m_zone->allocate_align(size, MSGPACK_ZONE_ALIGNOF(msgpack::object)));
172175
}
@@ -194,10 +197,12 @@ class create_object_visitor : public msgpack::v2::null_visitor {
194197
obj->via.map.ptr = MSGPACK_NULLPTR;
195198
}
196199
else {
197-
size_t size = num_kv_pairs*sizeof(msgpack::object_kv);
198-
if (size / sizeof(msgpack::object_kv) != num_kv_pairs) {
200+
201+
#if SIZE_MAX == UINT_MAX
202+
if (num_kv_pairs > SIZE_MAX/sizeof(msgpack::object_kv))
199203
throw msgpack::map_size_overflow("map size overflow");
200-
}
204+
#endif // SIZE_MAX == UINT_MAX
205+
size_t size = num_kv_pairs*sizeof(msgpack::object_kv);
201206
obj->via.map.ptr =
202207
static_cast<msgpack::object_kv*>(m_zone->allocate_align(size, MSGPACK_ZONE_ALIGNOF(msgpack::object_kv)));
203208
}

0 commit comments

Comments
 (0)