Repository navigation
Reject ext32 length 0xffffffff in the C unpacker - #761
Merged
Merged
Conversation
The trail length of an ext value includes the typecode byte, so 0xffffffff + 1 wrapped to zero in 32-bit arithmetic. Unpacker.skip() then treated the 5-byte ext32 header as a complete object and parsed the remaining bytes as the next object. unpack() was already rejected by the max_ext_len check, but with a confusing "0 exceeds" message. Raise ValueError before adding the typecode byte. Reported by Oz Kaiser (@tatikoma). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues for the ext32 length-overflow fix.
No open issues 🎉
What changed in this PR
This PR fixes an integer overflow in the C unpacker when an ext32 value declares a length of 0xffffffff, preventing Unpacker.skip() from treating its header as a complete object.
Changes:
- Reject the maximum ext32 length with
ValueErrorbefore adding the typecode byte. - Add regression coverage for both
Unpacker.unpack()andUnpacker.skip().
| File | Description |
|---|---|
test/test_limits.py |
Adds a parameterized test rejecting the maximum ext32 length. |
msgpack/unpack_template.h |
Guards against overflow when calculating the ext32 trailing length. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The trail length of an ext value includes the typecode byte, so an ext32 length of
0xffffffffwrapped to zero after+ 1in 32-bit arithmetic.Unpacker.skip()treated the 5-byte ext32 header as a complete object and parsed the remaining bytes as the next object.unpack()/unpackb()were already rejected by themax_ext_lencheck, but with a confusing0 exceeds max_ext_len(...)message.This PR raises
ValueErrorbefore adding the typecode byte. The pure Python implementation is not affected.Reported by Oz Kaiser (@tatikoma).
🤖 Generated with Claude Code