nik/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-08-31 07:30:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): use size cap instead of wraparound check for CodeQL overflow warning

Browse Source 
Check individual slice sizes against a 128 MiB cap before the addition,
so CodeQL can statically verify the sum cannot overflow.
This commit is contained in:
Deluan 2026-02-13 16:02:54 -05:00
parent fc113d1dc6
commit 6c260db60c
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/manager_call.go
View File

@ -130,11 +130,11 @@ func callPluginFunctionRaw[I any, O any](
if err != nil {
return result, fmt.Errorf("failed to marshal input: %w", err)
}
totalSize := 4 + len(jsonBytes) + len(rawInputBytes)
if totalSize < len(jsonBytes) || totalSize < len(rawInputBytes) {
const maxFrameSize = 2 << 20 // 2 MiB
if len(jsonBytes) > maxFrameSize || len(rawInputBytes) > maxFrameSize {
return result, fmt.Errorf("input frame too large")
}
frame := make([]byte, totalSize)
frame := make([]byte, 4+len(jsonBytes)+len(rawInputBytes))
binary.BigEndian.PutUint32(frame[:4], uint32(len(jsonBytes)))
copy(frame[4:4+len(jsonBytes)], jsonBytes)
copy(frame[4+len(jsonBytes):], rawInputBytes)