Skip to content

u64->usize overflow in h1 decode on 32bit system  #4055

@cpud36

Description

@cpud36

The code in question:

let to_read = *remaining as usize;
let buf = ready!(body.read_mem(cx, to_read))?;
let num = buf.as_ref().len() as u64;

Here, if it ever happens that *remaining is divisible by usize::MAX, to_read will become 0 and the code will return an error IncompleteBody, which is clearly wrong.

Moreover, even in cases when remaining is not exactly divisible by usize::MAX, but has small remainder, this is suboptimal (and likely to produce remainder divisible by usize::MAX).

Maybe it is worth to replace this with saturating cast?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions