From fc113d1dc647ab7b08564824d9b826f63f58d7bf Mon Sep 17 00:00:00 2001 From: Deluan Date: Fri, 13 Feb 2026 15:55:43 -0500 Subject: [PATCH] fix(plugins): guard against integer overflow in callPluginFunctionRaw frame allocation Add overflow check before allocating the input frame buffer to prevent potential integer wraparound on 32-bit platforms (flagged by github-advanced-security). --- plugins/manager_call.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/manager_call.go b/plugins/manager_call.go index 9ed8ee94c..fbd46eb52 100644 --- a/plugins/manager_call.go +++ b/plugins/manager_call.go @@ -130,7 +130,11 @@ func callPluginFunctionRaw[I any, O any]( if err != nil { return result, fmt.Errorf("failed to marshal input: %w", err) } - frame := make([]byte, 4+len(jsonBytes)+len(rawInputBytes)) + totalSize := 4 + len(jsonBytes) + len(rawInputBytes) + if totalSize < len(jsonBytes) || totalSize < len(rawInputBytes) { + return result, fmt.Errorf("input frame too large") + } + frame := make([]byte, totalSize) binary.BigEndian.PutUint32(frame[:4], uint32(len(jsonBytes))) copy(frame[4:4+len(jsonBytes)], jsonBytes) copy(frame[4+len(jsonBytes):], rawInputBytes)