ec4329d · streamly · git.iko.soy

git.iko.soy/streamly

on master help sign in

Add bounds check in Serialize instance of Array

ec4329dHarendra Kumar3 years ago

core/src/Streamly/Internal/Data/Serialize/Type.hs+8−2

@@ -15,6 +15,7 @@ module Streamly.Internal.Data.Serialize.Type

15-- Imports

16--------------------------------------------------------------------------------

18+import Control.Monad (when)

18import Data.List (foldl')

19import Data.List (foldl')

19import Data.Proxy (Proxy (..))

20import Data.Proxy (Proxy (..))

20import Streamly.Internal.Data.Unbox (Unbox)

21import Streamly.Internal.Data.Unbox (Unbox)

@@ -274,9 +275,14 @@ instance Serialize (Array a) where

274 addSizeTo i (Array {..}) = i + (arrEnd - arrStart) + 8

275 addSizeTo i (Array {..}) = i + (arrEnd - arrStart) + 8

275

276

276 {-# INLINE deserializeAt #-}

277 {-# INLINE deserializeAt #-}

277− deserializeAt off arr end = do

278+ deserializeAt off arr len = do

278− (off1, byteLen) <- deserializeAt off arr end :: IO (Int, Int)

279+ (off1, byteLen) <- deserializeAt off arr len :: IO (Int, Int)

279 let off2 = off1 + byteLen

280 let off2 = off1 + byteLen

281+ when (off2 > len) $

282+ error

283+ $ "deserializeAt: accessing array at offset = "

284+ ++ show (off2 - 1)

285+ ++ " max valid offset = " ++ show (len - 1)

280 let slice = MutArray.MutArray arr off1 off2 off2

286 let slice = MutArray.MutArray arr off1 off2 off2

281 newArr <- MutArray.clone slice

287 newArr <- MutArray.clone slice

282 pure (off2, Array.unsafeFreeze newArr)

288 pure (off2, Array.unsafeFreeze newArr)