Repository navigation
Conversation
The trail length of an ext value includes the typecode byte, so 0xffffffff + 1 wrapped to zero in 32-bit arithmetic. Unpacker.skip() then treated the 5-byte ext32 header as a complete object and parsed the remaining bytes as the next object. unpack() was already rejected by the max_ext_len check, but with a confusing "0 exceeds" message. Raise ValueError before adding the typecode byte. Reported by Oz Kaiser (@tatikoma). Co-Authored-By: Claude Opus 5.5 <[email protected]>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The trail length of an ext value includes the typecode byte, so an ext32 length of
0xffffffffwrapped to zero after+ 1in 32-bit arithmetic.Unpacker.skip()treated the 5-byte ext32 header as a complete object and parsed the remaining bytes as the next object.unpack()/unpackb()were already rejected by themax_ext_lencheck, but with a confusing0 exceeds max_ext_len(...)message.This PR raises
ValueErrorbefore adding the typecode byte. The pure Python implementation is not affected.Reported by Oz Kaiser (@tatikoma).
🤖 Generated with Claude Code