From 8a48af0e3ed15ce0e60273de30a073ae6419489e Mon Sep 17 00:00:00 2001 From: Takatoshi Kondo Date: Tue, 25 Aug 2026 11:44:54 +0900 Subject: [PATCH] Fix #1181 Fix integer overflow on msgpack_unpacker_expand_buffer(). CVE: CVE-2026-72854 Upstream-Status: Backport [https://github.com/msgpack/msgpack-c/commit/8a48af0e3ed15ce0e60273de30a073ae6419489e] Signed-off-by: Peter Marko --- .gitignore | 2 ++ CHANGELOG.md | 3 +++ src/unpack.c | 9 +++++++- test/streaming_c.cpp | 51 ++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 64 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index b9dc789b..f046aab4 100644 --- a/.gitignore +++ b/.gitignore @@ -27,6 +27,8 @@ Makefile .deps .libs +build + # Files generated by make. *.o *.so diff --git a/CHANGELOG.md b/CHANGELOG.md index fc2ffa5b..9e30edfe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +# 2026-08-25 version 6.0.0-patched + * Fix integer overflow on msgpack_unpacker_expand_buffer(). (#1182) + # 2023-03-02 version 6.0.0 * Remove C++ requirement if test is disabled (#1055) ## << breaking changes >> diff --git a/src/unpack.c b/src/unpack.c index 9341cb08..2d02a721 100644 --- a/src/unpack.c +++ b/src/unpack.c @@ -442,7 +442,11 @@ bool msgpack_unpacker_expand_buffer(msgpack_unpacker* mpac, size_t size) if(mpac->off == COUNTER_SIZE) { char* tmp; - size_t next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE + size_t next_size; + if(size > SIZE_MAX - mpac->used) { + return false; + } + next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE while(next_size < size + mpac->used) { size_t tmp_next_size = next_size * 2; if (tmp_next_size <= next_size) { @@ -464,6 +468,9 @@ bool msgpack_unpacker_expand_buffer(msgpack_unpacker* mpac, size_t size) char* tmp; size_t next_size = mpac->initial_buffer_size; // include COUNTER_SIZE size_t not_parsed = mpac->used - mpac->off; + if(size > SIZE_MAX - not_parsed - COUNTER_SIZE) { + return false; + } while(next_size < size + not_parsed + COUNTER_SIZE) { size_t tmp_next_size = next_size * 2; if (tmp_next_size <= next_size) { diff --git a/test/streaming_c.cpp b/test/streaming_c.cpp index d75bfbe5..ebf73362 100644 --- a/test/streaming_c.cpp +++ b/test/streaming_c.cpp @@ -192,3 +192,54 @@ TEST(streaming, basic_with_size) msgpack_unpacker_free(unp); msgpack_sbuffer_free(buffer); } + +// https://github.com/msgpack/msgpack-c/issues/1181 +TEST(streaming, reserve_buffer_overflow_rewound) +{ + msgpack_unpacker mpac; + ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8)); + + // off == COUNTER_SIZE path: size + used would wrap + size_t request = SIZE_MAX - 2; + EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request)); + + // a sane request still works + EXPECT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, 64)); + EXPECT_GE(msgpack_unpacker_buffer_capacity(&mpac), static_cast(64)); + + msgpack_unpacker_destroy(&mpac); +} + +TEST(streaming, reserve_buffer_overflow_not_rewound) +{ + msgpack_unpacker mpac; + ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8)); + + // consume part of the buffer so off != COUNTER_SIZE + msgpack_sbuffer sbuf; + msgpack_sbuffer_init(&sbuf); + msgpack_packer pk; + msgpack_packer_init(&pk, &sbuf, msgpack_sbuffer_write); + msgpack_pack_int(&pk, 1); + msgpack_pack_int(&pk, 2); + + ASSERT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, sbuf.size)); + memcpy(msgpack_unpacker_buffer(&mpac), sbuf.data, sbuf.size); + msgpack_unpacker_buffer_consumed(&mpac, sbuf.size); + + msgpack_unpacked result; + msgpack_unpacked_init(&result); + ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result)); + EXPECT_EQ(1, result.data.via.i64); + + size_t request = SIZE_MAX - 2; + EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request)); + + // remaining data must still be parsable + ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result)); + EXPECT_EQ(2, result.data.via.i64); + + msgpack_unpacked_destroy(&result); + msgpack_sbuffer_destroy(&sbuf); + msgpack_unpacker_destroy(&mpac); +}