go: fixes 8 crashers found by fuzzing

dgryski · dgryski · commit c254cc3f2c48 · 2015-05-01T12:07:54.000+02:00
Mostly bounds checks.  It's found some cases where we're not checking
map or array size and we run out of memory.  Uncertain how to handle
this for the moment.  There's also an infinite-recursion-on-copy bug not
fixed.
diff --git a/Go/sereal/decode.go b/Go/sereal/decode.go
@@ -20,6 +20,11 @@ type serealHeader struct {
 }
 
 func readHeader(b []byte) (serealHeader, error) {
+
+	if len(b) <= headerSize {
+		return serealHeader{}, ErrBadHeader
+	}
+
 	first4Bytes := binary.LittleEndian.Uint32(b[:4])
 
 	var h serealHeader
@@ -112,6 +117,10 @@ func (d *Decoder) UnmarshalHeaderBody(b []byte, vheader interface{}, vbody inter
 
 	bodyStart := headerSize + header.suffixSize
 
+	if bodyStart > len(b) || bodyStart < 0 {
+		return ErrCorrupt{errBadOffset}
+	}
+
 	switch header.version {
 	case 1:
 		break
@@ -401,7 +410,7 @@ func (d *Decoder) decodeDouble(by []byte, idx int) (float64, int, error) {
 }
 
 func (d *Decoder) decodeHash(by []byte, idx int, ln int, ptr *interface{}, isRef bool) (int, error) {
-	if ln < 0 || ln > math.MaxInt32 {
+	if ln < 0 || ln > math.MaxInt32 || 2*ln > len(by) {
 		return 0, ErrCorrupt{errBadHashSize}
 	}
 
@@ -435,7 +444,7 @@ func (d *Decoder) decodeHash(by []byte, idx int, ln int, ptr *interface{}, isRef
 }
 
 func (d *Decoder) decodeArray(by []byte, idx int, ln int, ptr *interface{}, isRef bool) (int, error) {
-	if ln < 0 || ln > math.MaxInt32 {
+	if ln < 0 || ln > math.MaxInt32 || ln > len(by) {
 		return 0, ErrCorrupt{errBadSliceSize}
 	}
 
@@ -466,7 +475,7 @@ func (d *Decoder) decodeArray(by []byte, idx int, ln int, ptr *interface{}, isRe
 }
 
 func (d *Decoder) decodeBinary(by []byte, idx int, ln int, makeCopy bool) ([]byte, int, error) {
-	if ln < 0 {
+	if ln < 0 || ln > math.MaxInt32 {
 		return nil, 0, ErrCorrupt{errBadStringSize}
 	} else if idx+ln > len(by) {
 		return nil, 0, ErrTruncated
@@ -510,7 +519,7 @@ func (d *Decoder) decodeStringish(by []byte, idx int) ([]byte, int, error) {
 		ln, sz := varintdecode(by[idx:])
 		idx += sz
 
-		if ln < 0 {
+		if ln < 0 || ln > math.MaxInt32 {
 			return nil, 0, ErrCorrupt{errBadStringSize}
 		} else if idx+ln > len(by) {
 			return nil, 0, ErrTruncated
diff --git a/Go/sereal/snappy.go b/Go/sereal/snappy.go
@@ -1,5 +1,7 @@
 package sereal
 
+import "math"
+
 // SnappyCompressor compresses a Sereal document using the Snappy format.
 type SnappyCompressor struct {
 	Incremental bool // enable incremental parsing
@@ -30,6 +32,9 @@ func (c SnappyCompressor) compress(b []byte) ([]byte, error) {
 func (c SnappyCompressor) decompress(b []byte) ([]byte, error) {
 	if c.Incremental {
 		ln, sz := varintdecode(b)
+		if ln < 0 || sz+ln > len(b) || ln > math.MaxInt32 {
+			return nil, ErrCorrupt{errBadOffset}
+		}
 		b = b[sz : sz+ln]
 	}
 
diff --git a/Go/sereal/zlib.go b/Go/sereal/zlib.go
@@ -1,6 +1,9 @@
 package sereal
 
-import "compress/zlib"
+import (
+	"compress/zlib"
+	"math"
+)
 
 // ZlibCompressor compresses a Sereal document using the zlib format.
 type ZlibCompressor struct {
@@ -47,6 +50,11 @@ func (c ZlibCompressor) decompress(buf []byte) ([]byte, error) {
 
 	// Read the claimed length of the compressed document
 	cln, csz := varintdecode(buf)
+
+	if cln < 0 || cln > math.MaxInt32 || csz+cln > len(buf) {
+		return nil, ErrCorrupt{errBadOffset}
+	}
+
 	buf = buf[csz : csz+cln]
 
 	// XXX Perhaps check if len(buf) == cln
