Skip to content

Commit 1e474cf

Browse files
Copilotmaxtropetsachamayou
authored
Fix integer overflow in snapshot segment parsing (EA7.1) (#7825)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: maxtropets <16566519+maxtropets@users.noreply.github.com> Co-authored-by: achamayou <4016369+achamayou@users.noreply.github.com>
1 parent 8b19ecc commit 1e474cf

1 file changed

Lines changed: 9 additions & 0 deletions

File tree

src/node/snapshot_serdes.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,15 @@ namespace ccf
5252
throw std::logic_error("Snapshot transaction size should not be zero");
5353
}
5454

55+
if (store_snapshot_size > size)
56+
{
57+
throw std::invalid_argument(fmt::format(
58+
"Snapshot transaction header claims size {} which exceeds available "
59+
"buffer size {}",
60+
store_snapshot_size,
61+
size));
62+
}
63+
5564
const auto* receipt_data = data + store_snapshot_size;
5665
auto receipt_size = size - store_snapshot_size;
5766

0 commit comments

Comments
 (0)