Skip to content

fix(gix-bitmap): Reject chunk length that overflows 32-bit usize - #3013

Merged
Sebastian Thiel (Byron) merged 1 commit into
GitoxideLabs:mainfrom
Mrmaxmeier:fix-gix-bitmap-ewah-usize32-overflow
Sep 23, 2026
Merged

Sebastian Thiel (Byron) merged 1 commit into
GitoxideLabs:mainfrom
Mrmaxmeier:fix-gix-bitmap-ewah-usize32-overflow

Conversation

@Mrmaxmeier

@Mrmaxmeier Mrmaxmeier commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

Hi,
I ran into this panic with the ewah fuzz target on 32-bit platforms (i686, WASM):

panicked at /rustc/.../library/alloc/src/raw_vec/mod.rs:28:5: capacity overflow

  19: core::panicking::panic_fmt
             at /rustc/.../library/core/src/panicking.rs:80:14
  20: alloc::raw_vec::capacity_overflow
             at /rustc/.../library/alloc/src/raw_vec/mod.rs:28:5
  25: <alloc::vec::Vec<u64>>::with_capacity
             at /rustc/.../library/alloc/src/vec/mod.rs:525:9
  26: gix_bitmap::ewah::decode
             at /tmp/gitoxide/gix-bitmap/src/ewah.rs:22:19

It happens in gix_bitmap::ewah::decode(&[0, 0, 0, 0, 0x20, 0, 0, 0]) because len * 8 overflows usize.
This PR uses a checked multiplication instead. saturating_mul would also work but the explicit error message might be nice to have. Let me know if I should replace the patch with a single-line saturating_mul one and/or add a test.

Thanks!

@Byron Sebastian Thiel (Byron) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much!

@Byron
Sebastian Thiel (Byron) merged commit c02041d into GitoxideLabs:main Sep 23, 2026
32 checks passed
@Mrmaxmeier
Mrmaxmeier deleted the fix-gix-bitmap-ewah-usize32-overflow branch September 23, 2026 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants