samuelcolvin / xdelta3-python

Fast delta encoding in python using xdelta3
Other
34 stars 15 forks source link

Fix exception when decoded value is too large by doubling buffer #4

Open karamanolev opened 6 years ago

karamanolev commented 6 years ago
  1. No need for the test files. There's a much simpler reproduction, which I included in the tests.
  2. Removed the test for NoDelta found. This will be covered in the logic for doubling the buffer. This changes the API a bit, since now you are free to get a larger delta than the second argument. However, I think that this is, in fact, the correct behavior from an API standpoint. Imagine you write your code, test it with reasonable inputs, everything works. One day your production code breaks, because of some edge case. I think cases of larger delta than the input should be handled by the client code, if it's actually an issue. Otherwise you will just surprise them badly.
  3. The above actually removes the need for the NoDelta exception, so it's removed as well.
  4. sizeof(int) - 4 is horrible, but I'm too lazy ATM to implement the correct solution, which is to check that you didn't overflow the int when left shifting in those 2 places. The error handling logic will be more complicated as well.
  5. The sprintf had a buffer overflow vulnerability. Fixed by using snprintf. I agree this can get a string truncated, but is much better than it was before.
codecov[bot] commented 6 years ago

Codecov Report

Merging #4 into master will not change coverage. The diff coverage is 100%.

@@          Coverage Diff          @@
##           master     #4   +/-   ##
=====================================
  Coverage     100%   100%           
=====================================
  Files           2      2           
  Lines          42     42           
=====================================
  Hits           42     42
samuelcolvin commented 6 years ago

@karamanolev do you want to complete this?

karamanolev commented 6 years ago

@samuelcolvin I'll address these soon, hopefully I'll find some time. Sorry.

samuelcolvin commented 6 years ago

No problems, thank you.