From 330a25a58a5c2bb9cdc392ff6919dae591fa6800 Mon Sep 17 00:00:00 2001 From: Songstats Audit Date: Sat, 29 Aug 2026 22:14:11 +0200 Subject: [PATCH] Prevent definite map length overflow --- ext/cbor/unpacker.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ext/cbor/unpacker.c b/ext/cbor/unpacker.c index 9cd43e4..1436f53 100644 --- a/ext/cbor/unpacker.c +++ b/ext/cbor/unpacker.c @@ -395,7 +395,9 @@ static int read_primitive(msgpack_unpacker_t* uk) if (val == 0) { return object_complete(uk, rb_hash_new()); } - return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, val*2, rb_hash_new()); + return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, + val > SIZE_MAX / 2 ? SIZE_MAX : val*2, + rb_hash_new()); CASE_AI(MT_TAG): READ_VAL(uk, ai, val); CASE_IMM(MT_TAG): // tag @@ -773,4 +775,3 @@ int msgpack_unpacker_skip_nil(msgpack_unpacker_t* uk) } return 0; } -