From 78ff9911c5fdc4f3f6c1cb71f3e59cda8c7fe098 Mon Sep 17 00:00:00 2001 From: jsvisa Date: Tue, 4 Nov 2025 17:15:50 +0800 Subject: [PATCH] triedb/pathdb: fix 32-bit integer overflow in history trienode decoder --- triedb/pathdb/history_trienode.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/triedb/pathdb/history_trienode.go b/triedb/pathdb/history_trienode.go index 3f45b41117..761bde5c37 100644 --- a/triedb/pathdb/history_trienode.go +++ b/triedb/pathdb/history_trienode.go @@ -19,6 +19,7 @@ package pathdb import ( "bytes" "encoding/binary" + "errors" "fmt" "iter" "maps" @@ -392,6 +393,12 @@ func decodeSingle(keySection []byte, onValue func([]byte, int, int) error) ([]st nValue, nn := binary.Uvarint(keySection[keyOff:]) // value length (varint) keyOff += nn + // Validate that the values can fit in an int to prevent overflow on 32-bit systems + const maxInt = int(^uint(0) >> 1) + if nShared > uint64(maxInt) || nUnshared > uint64(maxInt) || nValue > uint64(maxInt) { + return nil, errors.New("key size too large") + } + // Resolve unshared key if keyOff+int(nUnshared) > len(keySection) { return nil, fmt.Errorf("key length too long, unshared key length: %d, off: %d, section size: %d", nUnshared, keyOff, len(keySection))