From 815fefbb222c4d8167829face4f473bf60be6f0c Mon Sep 17 00:00:00 2001 From: J Wyman Date: Mon, 3 Nov 2025 16:08:19 -0500 Subject: [PATCH] Add Integer Overflow Sanity Check This change adds a sanity check prior to a static cast of `int32_t` to `int64_t` to use as an offset. While the current code cannot enter this state, this protects against future changes. Co-authored-by: Yingge He <157551214+yinggeh@users.noreply.github.com> --- src/http_server.cc | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/http_server.cc b/src/http_server.cc index 860cb06350..bfb8150ea0 100644 --- a/src/http_server.cc +++ b/src/http_server.cc @@ -606,8 +606,14 @@ ReadDataFromJsonHelper( const char* cstr; size_t len = 0; RETURN_IF_ERR(tensor_data.AsString(&cstr, &len)); - if (static_cast(*counter + len + sizeof(uint32_t)) > - expected_cnt) { + // Quick sanity check to ensure we don't write beyond `expected_cnt`. + int32_t actual_cnt = *counter + len + sizeof(uint32_t); + if (actual_cnt < 0) { + return TRITONSERVER_ErrorNew( + TRITONSERVER_ERROR_INTERNAL, + "Unable to parse 'data' field: string length is negative"); + } + if (static_cast(actual_cnt) > expected_cnt) { return TRITONSERVER_ErrorNew( TRITONSERVER_ERROR_INTERNAL, "Shape does not match true shape of 'data' field");