mirror of
https://github.com/oven-sh/bun
synced 2026-02-02 15:08:46 +00:00
Fix integer overflow when reading MySQL OK packets (#23993)
### Description This PR fixes a crash caused by integer underflow in `OKPacket.decodeInternal`. Previously, when `read_size` exceeded `packet_size`, the subtraction `packet_size - read_size` wrapped around, producing a huge `count` value passed into `reader.read()`. This led to an integer overflow panic at runtime. ### What does this PR do - Added a safe subtraction guard in `decodeInternal` to clamp `remaining` to `0` when `read_size >= packet_size`. - Ensures empty or truncated OK packets no longer cause crashes. - Behavior for valid packets remains unchanged. ### Impact Prevents integer overflow panics in MySQL OK packet parsing, improving stability when handling short or empty responses (e.g., queries that return no rows or minimal metadata). ### How did you verify your code works? Tested with proof of concept: https://github.com/Lillious/Bun-MySql-Integer-Overflow-PoC --------- Co-authored-by: Ciro Spaciari <ciro.spaciari@gmail.com>
This commit is contained in:
@@ -33,9 +33,9 @@ pub fn decodeInternal(this: *OKPacket, comptime Context: type, reader: NewReader
|
||||
this.warnings = try reader.int(u16);
|
||||
|
||||
// Info (EOF-terminated string)
|
||||
if (reader.peek().len > 0) {
|
||||
// everything else is info
|
||||
this.info = try reader.read(@truncate(this.packet_size - read_size));
|
||||
if (reader.peek().len > 0 and this.packet_size > read_size) {
|
||||
const remaining = this.packet_size - read_size;
|
||||
this.info = try reader.read(@truncate(remaining));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user