FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Fix integer overflow in buffer length calculation for unpack('m') and unpack('u') by ikaronen-relex · Pull Request #8936 · jruby/jruby · GitHub

/ jruby Public

Fix integer overflow in buffer length calculation for unpack('m') and unpack('u') - #8936

Merged
enebo merged 2 commits into
jruby:masterfrom
ikaronen-relex:unpack-buffer-size-overflow
Aug 1, 2025
Merged

Fix integer overflow in buffer length calculation for unpack('m') and unpack('u')#8936
enebo merged 2 commits into
jruby:masterfrom
ikaronen-relex:unpack-buffer-size-overflow

Conversation

Copy link
Copy Markdown
Contributor

This fixes #8933

ikaronen-relex force-pushed the unpack-buffer-size-overflow branch 4 times, most recently from dc0600e to b511c28 Compare August 1, 2025 14:45
ikaronen-relex force-pushed the unpack-buffer-size-overflow branch from b511c28 to 42e8119 Compare August 1, 2025 15:09
ikaronen-relex marked this pull request as draft August 1, 2025 15:10
enebo modified the milestones: JRuby 10.0.2.0, JRuby 9.4.14.0 Aug 1, 2025

enebo commented Aug 1, 2025

Copy link
Copy Markdown
Member

@ikaronen-relex This is still marked WIP and it targets master which is JRuby 10.x. If you are not finished then please consider retargeting to jruby-9.4 (and we/I will merge it to 10 as well). If you are finished let me know and I will merge. I can also cherry-pick this back so just let me know when you are done.

ikaronen-relex marked this pull request as ready for review August 1, 2025 16:32

Copy link
Copy Markdown
Contributor Author

@enebo I marked it as draft since I was getting some test failures due to OOM errors. Looks like the tests pass now, so I've marked it as ready.

In the process, I also fixed what appears to be an unnecessary array copy in Pack.unpackBase46Strict. That didn't fix the OOMs (but apparently splitting the specs into several smaller ones did), but I left it in since I think it's still a reasonable (and safe, AFAICT!) optimization.

}
}
return newString(context, new ByteList(out, 0, index));
return newString(context, new ByteList(out, 0, index, false));

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Passing false here avoids an unnecessary array copy in the ByteList constructor. The out array isn't otherwise exposed outside this method, so avoiding the copy seems safe to me.

ikaronen-relex force-pushed the unpack-buffer-size-overflow branch from 0edc0fb to 192993d Compare August 1, 2025 17:35

enebo commented Aug 1, 2025

Copy link
Copy Markdown
Member

@ikaronen-relex Yeah I noticed you caught the extra arraycopy. Good find.

enebo merged commit c2b9fdd into jruby:master Aug 1, 2025
72 checks passed
ikaronen-relex deleted the unpack-buffer-size-overflow branch September 19, 2025 10:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Output buffer size calculation for unpack('m') and unpack('u') can overflow for long inputs

2 participants


Back | FazBrowse Home | New Git URL