Skip to content

Conversation

jgowdy-godaddy
Copy link
Collaborator

Summary

  • Fixes 3 critical integer overflow vulnerabilities identified in code review
  • Uses performance-conscious approaches with branch prediction hints

Changes

  1. SetMaxStackAllocItemSize: Clamp values to [0, 1MB] range using std::max/min
  2. EstimateAsherahOutputSize: Add overflow check only for suspiciously large data (>1TB)
  3. AllocationSizeToMaxDataSize: Add buffer underflow check with unlikely branch hint

Performance Impact

  • Minimal overhead by using branch prediction hints (unlikely())
  • Overflow checks only trigger for edge cases
  • No performance impact on common code paths

Test plan

  • All existing tests pass
  • Manually tested with edge case values
  • No performance regression in benchmarks

🤖 Generated with Claude Code

- SetMaxStackAllocItemSize: Clamp values to [0, 1MB] range using std::max/min
- EstimateAsherahOutputSize: Add overflow check only for suspiciously large data (>1TB)
- AllocationSizeToMaxDataSize: Add buffer underflow check with unlikely branch hint

All fixes use performance-conscious approaches with branch prediction hints
@jgowdy-godaddy jgowdy-godaddy force-pushed the fix-integer-overflow-issues branch from ce0c45e to 866042c Compare August 3, 2025 19:37
@jgowdy-godaddy jgowdy-godaddy force-pushed the fix-integer-overflow-issues branch from 8e29030 to 70c5c05 Compare August 3, 2025 19:57
Force use of installed Go version (1.24.0) instead of allowing automatic
download of Go 1.24.1 which causes version mismatch errors in CI.
Prevent version conflict error when dry-running npm publish since
the package.json version is 0.0.0 but published version is 3.0.8.
Fix arm64 build failure caused by undefined unlikely() macro.
The scoped_allocate.h file uses unlikely() but didn't include
hints.h where the macro is defined.
The CI npm version requires a tag when the package.json version (0.0.0)
is lower than the published version (3.0.8), even for dry-run.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant