Skip to content

[io] adjust array length checks in text-based buffers #21463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
linev merged 1 commit into from
Mar 4, 2026
Merged

[io] adjust array length checks in text-based buffers #21463

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions io/io/src/TBufferJSON.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3346,11 +3346,9 @@ void TBufferJSON::JsonWriteFastArray(const T *arr, Long64_t arrsize, const char
fValue.Append("[]");
return;
}
constexpr Int_t dataWidth = 1; // at least 1
const Int_t maxElements = (std::numeric_limits<Int_t>::max() - Length())/dataWidth;
if (arrsize > maxElements)
{
Fatal("JsonWriteFastArray", "Not enough space left in the buffer (1GB limit). %lld elements is greater than the max left of %d", arrsize, maxElements);
const Int_t maxElements = std::numeric_limits<Int_t>::max();
if (arrsize > maxElements) {
Fatal("JsonWriteFastArray", "Array larger than 2^31 elements cannot be stored in JSON");
return; // In case the user re-routes the error handler to not die when Fatal is called
}

Expand Down
11 changes: 4 additions & 7 deletions io/sql/src/TBufferSQL2.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1376,15 +1376,12 @@ Int_t TBufferSQL2::SqlReadArraySize()
template <typename T>
R__ALWAYS_INLINE void TBufferSQL2::SqlWriteArray(T *arr, Long64_t arrsize, Bool_t withsize)
{
constexpr Int_t dataWidth = 1; // at least 1
const Int_t maxElements = (std::numeric_limits<Int_t>::max() - Length())/dataWidth;
if (arrsize < 0 || arrsize > maxElements)
{
Fatal("SqlWriteArray", "Not enough space left in the buffer (1GB limit). %lld elements is greater than the max left of %d", arrsize, maxElements);
return; // In case the user re-routes the error handler to not die when Fatal is called
}
if (!withsize && (arrsize <= 0))
return;
if (arrsize > std::numeric_limits<Int_t>::max()) {
Fatal("SqlWriteArray", "Array larger than 2^31 elements cannot be stored in SQL");
return; // In case the user re-routes the error handler to not die when Fatal is called
}
PushStack()->SetArray(withsize ? arrsize : -1);
Int_t indx = 0;
if (fCompressLevel > 0) {
Expand Down
11 changes: 4 additions & 7 deletions io/xml/src/TBufferXML.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2160,16 +2160,13 @@ void TBufferXML::WriteArray(const Double_t *d, Int_t n)
template <typename T>
R__ALWAYS_INLINE void TBufferXML::XmlWriteFastArray(const T *arr, Long64_t n)
{
constexpr Int_t dataWidth = 1; // at least 1
const Int_t maxElements = (std::numeric_limits<Int_t>::max() - Length())/dataWidth;
if (n < 0 || n > maxElements)
{
Fatal("XmlWriteFastArray", "Not enough space left in the buffer (1GB limit). %lld elements is greater than the max left of %d", n, maxElements);
return; // In case the user re-routes the error handler to not die when Fatal is called
}
BeforeIOoperation();
if (n <= 0)
return;
if (n > std::numeric_limits<Int_t>::max()) {
Fatal("XmlWriteFastArray", "Array larger than 2^31 elements cannot be stored in XML");
return; // In case the user re-routes the error handler to not die when Fatal is called
}
XMLNodePointer_t arrnode = CreateItemNode(xmlio::Array);
PushStack(arrnode);
XmlWriteArrayContent(arr, n);
Expand Down
Loading