BigfootDev/flatbuffers
1
0
Fork 1
mirror of https://github.com/google/flatbuffers.git synced 2026-06-01 19:58:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Swift] Fix verifier accepting truncated scalar vectors (OOB read/write, RCE) (#9081)

Browse Source
This commit is contained in:
Ali Sherif
2026-05-08 11:16:10 +03:00
committed by GitHub
parent 392165432a
commit 1f438bd40f
2 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
swift/Sources/FlatBuffers/Verifiable.swift
View File

@@ -56,8 +56,15 @@ extension Verifiable {
let len: UOffset = try verifier.getValue(at: position)
let intLen = Int(len)
let start = Int(clamping: (position &+ MemoryLayout<Int32>.size).magnitude)
let byteCount = intLen.multipliedReportingOverflow(
by: MemoryLayout<T>.size)
guard !byteCount.overflow else {
throw FlatbuffersErrors.outOfBounds(
position: UInt.max,
end: verifier.capacity)
}
try verifier.isAligned(position: start, type: type.self)
try verifier.rangeInBuffer(position: start, size: intLen)
try verifier.rangeInBuffer(position: start, size: byteCount.partialValue)
return (start, intLen)
}
}