Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[protobuf] _decode32Bits() bug in ProtobufParser #85

Closed
marsqing opened this issue May 3, 2017 · 2 comments
Closed

[protobuf] _decode32Bits() bug in ProtobufParser #85

marsqing opened this issue May 3, 2017 · 2 comments
Labels

Comments

@marsqing
Copy link
Contributor

marsqing commented May 3, 2017

protected final int _decode32Bits() throws IOException {
    int ptr = this._inputPtr;
    if(ptr + 3 >= this._inputEnd) {
      return this._slow32();
    } else {
      byte[] b = this._inputBuffer;
      int v = (b[ptr] & 255) + (b[ptr + 1] << 8) + ((b[ptr + 2] & 255) << 16) + (b[ptr + 3] << 24);
      this._inputPtr = ptr + 4;
      return v;
    }
  }

bug in the following line
int v = (b[ptr] & 255) + (b[ptr + 1] << 8) + ((b[ptr + 2] & 255) << 16) + (b[ptr + 3] << 24);

If b[prt+1] or b[ptr+3] is negative, << will preserve sign and the overall plus operation will corrupt. Float values like 123.456f will be incorrectly decoded.

_decode64Bits()'s logic is correct.

@marsqing marsqing changed the title _decode32Bits() bug in ProtobufParser [protobuf] _decode32Bits() bug in ProtobufParser May 3, 2017
@cowtowncoder
Copy link
Member

Thank you again for reporting this. I assume this is with latest version.

@cowtowncoder
Copy link
Member

Thanks! I added a test (and slightly improved one for double too) to catch this, fixed.
Wonder how I didn't notice it; bug is kind of obvious looking at code and I'm familiar with sign extension.
I'll fix this for 2.7, 2.8 and master (2.9.0).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants