gob: protect against invalid message length

Fixes #2301.

R=golang-dev, gri
CC=golang-dev
https://golang.org/cl/5134048

diff --git a/src/pkg/gob/decoder.go b/src/pkg/gob/decoder.go
index 2819471322542f45bd3cc58c40403eaa4b41bfd5..c2a1e0c3a8736c66b2dcbf3362ee35254bb98490 100644 (file)
--- a/src/pkg/gob/decoder.go
+++ b/src/pkg/gob/decoder.go
@@ -58,6 +58,8 @@ func (dec *Decoder) recvType(id typeId) {
        dec.wireType[id] = wire
 }
 
+var errBadCount = gobError{os.NewError("invalid message length")}
+
 // recvMessage reads the next count-delimited item from the input. It is the converse
 // of Encoder.writeMessage. It returns false on EOF or other error reading the message.
 func (dec *Decoder) recvMessage() bool {
@@ -67,6 +69,10 @@ func (dec *Decoder) recvMessage() bool {
                dec.err = err
                return false
        }
+       if nbytes >= 1<<31 {
+               dec.err = errBadCount
+               return false
+       }
        dec.readMessage(int(nbytes))
        return dec.err == nil
 }

diff --git a/src/pkg/gob/encoder_test.go b/src/pkg/gob/encoder_test.go
index 79d28970100d7cfc6f3837331fa68d5c53b45915..4263666393b1123d7e5570e2161fbb628fc68172 100644 (file)
--- a/src/pkg/gob/encoder_test.go
+++ b/src/pkg/gob/encoder_test.go
@@ -628,3 +628,13 @@ func TestSliceReusesMemory(t *testing.T) {
                }
        }
 }
+
+// Used to crash: negative count in recvMessage.
+func TestBadCount(t *testing.T) {
+       b := []byte{0xfb, 0xa5, 0x82, 0x2f, 0xca, 0x1}
+       if err := NewDecoder(bytes.NewBuffer(b)).Decode(nil); err == nil {
+               t.Error("expected error from bad count")
+       } else if err.String() != errBadCount.String() {
+               t.Error("expected bad count error; got", err)
+       }
+}