Skip to content

Commit f074a8b

Browse files
committed
fix length parsing vuln
1 parent 966037f commit f074a8b

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/sentry_envelope.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -815,10 +815,14 @@ sentry_envelope_deserialize(const char *buf, size_t buf_len)
815815
}
816816
item->payload_len = (size_t)(payload_end - ptr);
817817
} else if (sentry_value_get_type(length) == SENTRY_VALUE_TYPE_UINT64) {
818-
item->payload_len = (size_t)sentry_value_as_uint64(length);
818+
uint64_t payload_len = sentry_value_as_uint64(length);
819+
if (payload_len > SIZE_MAX) {
820+
goto fail;
821+
}
822+
item->payload_len = (size_t)payload_len;
819823
} else {
820824
int64_t payload_len = sentry_value_as_int64(length);
821-
if (payload_len < 0) {
825+
if (payload_len < 0 || (uint64_t)payload_len > SIZE_MAX) {
822826
goto fail;
823827
}
824828
item->payload_len = (size_t)payload_len;

0 commit comments

Comments
 (0)