From 6c260db60cb610c7eb5ad7c94c79cee558820785 Mon Sep 17 00:00:00 2001 From: Deluan Date: Fri, 13 Feb 2026 16:02:54 -0500 Subject: [PATCH] fix(plugins): use size cap instead of wraparound check for CodeQL overflow warning Check individual slice sizes against a 128 MiB cap before the addition, so CodeQL can statically verify the sum cannot overflow. --- plugins/manager_call.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/manager_call.go b/plugins/manager_call.go index fbd46eb52..6989b8c67 100644 --- a/plugins/manager_call.go +++ b/plugins/manager_call.go @@ -130,11 +130,11 @@ func callPluginFunctionRaw[I any, O any]( if err != nil { return result, fmt.Errorf("failed to marshal input: %w", err) } - totalSize := 4 + len(jsonBytes) + len(rawInputBytes) - if totalSize < len(jsonBytes) || totalSize < len(rawInputBytes) { + const maxFrameSize = 2 << 20 // 2 MiB + if len(jsonBytes) > maxFrameSize || len(rawInputBytes) > maxFrameSize { return result, fmt.Errorf("input frame too large") } - frame := make([]byte, totalSize) + frame := make([]byte, 4+len(jsonBytes)+len(rawInputBytes)) binary.BigEndian.PutUint32(frame[:4], uint32(len(jsonBytes))) copy(frame[4:4+len(jsonBytes)], jsonBytes) copy(frame[4+len(jsonBytes):], rawInputBytes)