.

wcfs/zblk.go

@@ -50,6 +50,7 @@ import (
 	"lab.nexedi.com/kirr/neo/go/zodb"
 	"lab.nexedi.com/kirr/neo/go/zodb/btree"
 	pickle "github.com/kisielk/og-rek"
+	"github.com/johncgriffin/overflow"
 
 	"./internal/pycompat"
 )
@@ -372,9 +373,12 @@ func (zb *ZBlk1) loadBlkData(ctx context.Context) (_ []byte, _ zodb.Tid, err err
 
 
         // find out whole blk len via inspecting tail chunk
-	tailStart := offv[len(offv)-1]
-	tailChunk := chunktab[tailStart]
-	blklen    := tailStart + int32(len(tailChunk.data))	// XXX overflow?
+	tailStart  := offv[len(offv)-1]
+	tailChunk  := chunktab[tailStart]
+	blklen, ok := overflow.Add32(tailStart, int32(len(tailChunk.data)))
+	if !ok {
+		return nil, 0, fmt.Errorf("invalid data: blklen overflow")
+	}
 
         // whole buffer initialized as 0 + tail_chunk
 	blkdata := make([]byte, blklen)
@@ -385,12 +389,12 @@ func (zb *ZBlk1) loadBlkData(ctx context.Context) (_ []byte, _ zodb.Tid, err err
 	for _, start := range offv[:len(offv)-1] {
 		chunk := chunktab[start]
 		if !(start >= stop) {	// verify chunks don't overlap
-			return nil, 0, fmt.Errorf("!(start >= stop)")	// XXX
+			return nil, 0, fmt.Errorf("invalid data: chunks overlap")
 		}
-		if !(start + int32(len(chunk.data)) <= int32(len(blkdata))) {	// XXX overflow?
-			return nil, 0, fmt.Errorf("blkdata overrun")	// XXX
+		stop, ok = overflow.Add32(start, int32(len(chunk.data)))
+		if !(ok && stop <= blklen) {
+			return nil, 0, fmt.Errorf("invalid data: blkdata overrun")
 		}
-		stop = start + int32(len(chunk.data))	// XXX overflow?
 		copy(blkdata[start:], chunk.data)
 	}