Add Integer Overflow Sanity Check

This change adds a sanity check prior to a static cast of `int32_t` to `int64_t` to use as an offset.

While the current code cannot enter this state, this protects against future changes.

Author: whoisj

src/http_server.cc

@@ -606,8 +606,14 @@ ReadDataFromJsonHelper(
         const char* cstr;
         size_t len = 0;
         RETURN_IF_ERR(tensor_data.AsString(&cstr, &len));
-        if (static_cast<int64_t>(*counter + len + sizeof(uint32_t)) >
-            expected_cnt) {
+        // Quick sanity check to ensure we don't write beyond `expected_cnt`.
+        int32_t value = *counter + len + sizeof(uint32_t);
+        if (len < 0 || value < 0) {
+          return TRITONSERVER_ErrorNew(
+              TRITONSERVER_ERROR_INTERNAL,
+              "Unable to parse 'data' field: string length is negative");
+        }
+        if (static_cast<int64_t>(value) > expected_cnt) {
           return TRITONSERVER_ErrorNew(
               TRITONSERVER_ERROR_INTERNAL,
               "Shape does not match true shape of 'data' field");