From 10d583adb67d0566af6c36a6c97fed69545421a2 Mon Sep 17 00:00:00 2001 From: SChernykh <15806605+SChernykh@users.noreply.github.com> Date: Mon, 23 Jun 2025 07:47:43 +0200 Subject: [PATCH] Added more checks to readVarint --- src/util.h | 5 +++++ tests/src/util_tests.cpp | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/src/util.h b/src/util.h index d295834..48af07c 100644 --- a/src/util.h +++ b/src/util.h @@ -186,6 +186,11 @@ const uint8_t* readVarint(const uint8_t* data, const uint8_t* data_end, T& b) } const uint64_t cur_byte = *(data++); + + if (k && (cur_byte == 0)) { + return nullptr; + } + result |= (cur_byte & 0x7F) << k; if ((k > 0) && (shiftleft128(cur_byte & 0x7F, 0, k) != 0)) { diff --git a/tests/src/util_tests.cpp b/tests/src/util_tests.cpp index 389f92b..c58e02d 100644 --- a/tests/src/util_tests.cpp +++ b/tests/src/util_tests.cpp @@ -90,6 +90,14 @@ TEST(util, varint) uint32_t check2; uint8_t buf4[] = {255, 255, 255, 255, 127}; ASSERT_EQ(readVarint(buf4, buf4 + sizeof(buf4), check2), nullptr); + + // Invalid value 5 + uint8_t buf5[] = {128, 0}; + ASSERT_EQ(readVarint(buf5, buf5 + sizeof(buf5), check), nullptr); + + // Invalid value 6 (2^64) + uint8_t buf6[] = {128, 128, 128, 128, 128, 128, 128, 128, 128, 2}; + ASSERT_EQ(readVarint(buf6, buf6 + sizeof(buf6), check), nullptr); } TEST(util, bsr)