codec: msgpack: enforce max container length of 2^32-1

Will not throw an error if the cotainer length exceeds messagepack limit
instead of doing best effort (which is wrong).

Fixes #433

Author: ugorji

codec/msgpack.base.go

@@ -61,6 +61,9 @@ const (
 	mpNegFixNumMax byte = 0xff
 )
 
+const mpMaxLen = 1<<32 - 1 // math.MaxUint32
+const mpMaxLenOverflowErrorMsgPrefix = "msgpack container length exceeds max of 2^32-1"
+
 var mpTimeExtTag int8 = -1
 var mpTimeExtTagU = uint8(mpTimeExtTag)
 

codec/msgpack.go

@@ -293,9 +293,11 @@ func (e *msgpackEncDriver[T]) writeContainerLen(ct msgpackContainerType, l int)
 	} else if l < 65536 {
 		e.w.writen1(ct.b16)
 		e.w.writen2(bigen.PutUint16(uint16(l)))
-	} else {
+	} else if l <= mpMaxLen {
 		e.w.writen1(ct.b32)
 		e.w.writen4(bigen.PutUint32(uint32(l)))
+	} else {
+		halt.errorf("%s: %d", mpMaxLenOverflowErrorMsgPrefix, l)
 	}
 }
 

codec/msgpack.mono.generated.go

@@ -3353,9 +3353,11 @@ func (e *msgpackEncDriverBytes) writeContainerLen(ct msgpackContainerType, l int
 	} else if l < 65536 {
 		e.w.writen1(ct.b16)
 		e.w.writen2(bigen.PutUint16(uint16(l)))
-	} else {
+	} else if l <= mpMaxLen {
 		e.w.writen1(ct.b32)
 		e.w.writen4(bigen.PutUint32(uint32(l)))
+	} else {
+		halt.errorf("%s: %d", mpMaxLenOverflowErrorMsgPrefix, l)
 	}
 }
 
@@ -7367,9 +7369,11 @@ func (e *msgpackEncDriverIO) writeContainerLen(ct msgpackContainerType, l int) {
 	} else if l < 65536 {
 		e.w.writen1(ct.b16)
 		e.w.writen2(bigen.PutUint16(uint16(l)))
-	} else {
+	} else if l <= mpMaxLen {
 		e.w.writen1(ct.b32)
 		e.w.writen4(bigen.PutUint32(uint32(l)))
+	} else {
+		halt.errorf("%s: %d", mpMaxLenOverflowErrorMsgPrefix, l)
 	}
 }
 

codec/msgpack_test.go

@@ -12,6 +12,7 @@ import (
 	"net/rpc"
 	"os/exec"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 )
@@ -108,6 +109,50 @@ func doTestMsgpackDecodeMapAndExtSizeMismatch(t *testing.T, h Handle) {
 	// fn(t, b, &s)
 }
 
+func doTestMsgpackIntOverflow(t *testing.T, h Handle) {
+	defer testSetup(t, &h)()
+	if cpu32Bit {
+		t.Skip("test skipped on 32-bit machine")
+	}
+	if testing.Short() {
+		t.Skip("skipping test in short mode")
+	}
+	overflowString := "\xa7input_b\xd9\x12HACKER OVERWRITTEN"
+	var sb = make([]byte, (1<<32)+len(overflowString)+64)
+	copy(sb, overflowString)
+	overflowString = stringView(sb)
+	// sb.Grow((1 << 32) + len(overflowString) + 64)
+	// sb.WriteString(overflowString)
+	// overflowString = sb.String()
+
+	type sampleT struct {
+		A string
+		B string
+	}
+
+	var v0, v1 sampleT
+	var b []byte
+	var err error
+
+	v0 = sampleT{"normal", "normal value"}
+	b = testMarshalErr(v0, h, t, "encode-normal")
+	testUnmarshalErr(&v1, b, h, t, "decode")
+	testDeepEqualErr(v0, v1, t, "compare")
+
+	v0 = sampleT{"hacker", overflowString}
+	b, err = testMarshal(v0, h)
+	if err == nil || !strings.Contains(err.Error(), mpMaxLenOverflowErrorMsgPrefix) {
+		t.Fatalf("expected error that len exceeds maximum")
+	}
+	// v1 = sampleT{}
+	// testUnmarshalErr(&v1, b, h, t, "decode")
+	// testDeepEqualErr(v0, v1, t, "compare")
+}
+
+func TestMsgpackIntOverflow(t *testing.T) {
+	doTestMsgpackIntOverflow(t, testMsgpackH)
+}
+
 func TestMsgpackCodecsTable(t *testing.T) {
 	doTestCodecTableOne(t, testMsgpackH)
 }