Fix potential array OOB

flanglet · May 11, 2024 · 7ee353d · 7ee353d
1 parent fd98764
commit 7ee353d
Showing 1 changed file with 24 additions and 14 deletions.
diff --git a/v2/transform/TextCodec.go b/v2/transform/TextCodec.go
@@ -1007,13 +1007,7 @@ func (this *textCodec1) Inverse(src, dst []byte) (uint, uint, error) {
 			}
 
 			pe := &this.dictList[idx]
-			length := int(pe.data >> 24)
-
-			// Sanity check
-			if pe.ptr == nil || dstIdx+length >= dstEnd {
-				err = errors.New("Text transform failed. Invalid input data")
-				break
-			}
+			length := int(pe.data>>24) & 0xFF
 
 			// Add space if only delimiter between 2 words (not an escaped delimiter)
 			if length > 1 {
@@ -1031,6 +1025,12 @@ func (this *textCodec1) Inverse(src, dst []byte) (uint, uint, error) {
 				delimAnchor = srcIdx - 1
 			}
 
+			// Sanity check
+			if pe.ptr == nil || dstIdx+length >= dstEnd {
+				err = errors.New("Text transform failed. Invalid input data")
+				break
+			}
+
 			// Emit word
 			copy(dst[dstIdx:], pe.ptr[0:length])
 
@@ -1047,6 +1047,11 @@ func (this *textCodec1) Inverse(src, dst []byte) (uint, uint, error) {
 			if (this.isCRLF == true) && (cur == LF) {
 				dst[dstIdx] = CR
 				dstIdx++
+
+				if dstIdx >= dstEnd {
+					err = errors.New("Text transform failed. Invalid input data")
+					break
+				}
 			}
 
 			dst[dstIdx] = cur
@@ -1539,13 +1544,7 @@ func (this *textCodec2) Inverse(src, dst []byte) (uint, uint, error) {
 			}
 
 			pe := &this.dictList[idx]
-			length := int(pe.data >> 24)
-
-			// Sanity check
-			if pe.ptr == nil || dstIdx+length >= dstEnd {
-				err = errors.New("Text transform failed. Invalid input data")
-				break
-			}
+			length := int(pe.data>>24) & 0xFF
 
 			// Add space if only delimiter between 2 words (not an escaped delimiter)
 			if length > 1 {
@@ -1563,6 +1562,12 @@ func (this *textCodec2) Inverse(src, dst []byte) (uint, uint, error) {
 				delimAnchor = srcIdx - 1
 			}
 
+			// Sanity check
+			if pe.ptr == nil || dstIdx+length >= dstEnd {
+				err = errors.New("Text transform failed. Invalid input data")
+				break
+			}
+
 			// Emit word
 			copy(dst[dstIdx:], pe.ptr[0:length])
 
@@ -1578,6 +1583,11 @@ func (this *textCodec2) Inverse(src, dst []byte) (uint, uint, error) {
 				if (this.isCRLF == true) && (cur == LF) {
 					dst[dstIdx] = CR
 					dstIdx++
+
+					if dstIdx >= dstEnd {
+						err = errors.New("Text transform failed. Invalid input data")
+						break
+					}
 				}
 
 				dst[dstIdx] = cur