From f642ea7c8dc88d947e53899605780d1c291fe77d Mon Sep 17 00:00:00 2001 From: Martin Dosch Date: Sun, 5 Jul 2026 20:08:42 +0200 Subject: [PATCH] removeLen32Prefixed: check for possible data overflow --- abe/cpabe/tkn20/internal/tkn/util.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/abe/cpabe/tkn20/internal/tkn/util.go b/abe/cpabe/tkn20/internal/tkn/util.go index 0c0f94f1c..6aac952f4 100644 --- a/abe/cpabe/tkn20/internal/tkn/util.go +++ b/abe/cpabe/tkn20/internal/tkn/util.go @@ -77,6 +77,9 @@ func removeLen32Prefixed(data []byte) (next []byte, remainder []byte, err error) return nil, nil, fmt.Errorf("data too short") } itemLen := int(binary.LittleEndian.Uint32(data)) + if itemLen < 0 { + return nil, nil, fmt.Errorf("negative data length: possible overflow") + } if (4 + itemLen) > len(data) { return nil, nil, fmt.Errorf("data too short") }