fix(buffer): prevent integer overflow in grow_if_necessary#3317
Open
fix(buffer): prevent integer overflow in grow_if_necessary#3317
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Collaborator
Pull Request Test Coverage Report for Build 3092Details
💛 - Coveralls |
bobzhang
force-pushed
the
hongbo/buffer-overflow-guard
branch
3 times, most recently
from
3d70abe to
8c2657b
Compare
When the buffer capacity exceeds Int max / 2, doubling would overflow. Add a guard to fall back to the exact required size instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
bobzhang
force-pushed
the
hongbo/buffer-overflow-guard
branch
from
8c2657b to
314ea48
Compare
| } | ||
| // Guard against integer overflow: when space > Int max / 2 (1073741823), | ||
| // doubling would exceed 32-bit Int range. Fall back to exact allocation. | ||
| if space > 1073741823 { |
Collaborator
There was a problem hiding this comment.
We might use a constant instead of a random number. Also the current runtime should be put into account -> moonbitlang/moonbit-docs#1155
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
Buffer::grow_if_necessarydoubles the capacity in a loop until it meets the required size. When the current capacity exceedsInt.max_value / 2(~1 billion),space * 2overflows to a negative value, causing either an infinite loop or a panic when allocating with a negative size.Fix
Add a guard: when
space > 1073741823(Int max / 2), fall back to allocating exactly the required size instead of doubling.Test plan
🤖 Generated with Claude Code