diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2019-07-26 10:43:08 +0200 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2019-07-26 10:43:08 +0200 |
| commit | 3e5d1beb82bfcac82b760b0113b14c891284070f (patch) | |
| tree | 332eae1b4f9fd5e52a43ab78cc3cf10726a39d35 /prog/mutation.go | |
| parent | cf49ed5769e95e2146c56883ebc957b22713381a (diff) | |
prog: fix crash in blob mutation
If we deserialized a huge blob (larger than max blob size),
then we can get a negative size in the "Insert random bytes" case at:
if r := int(maxLen) - len(data); n > r {
n = r
}
Don't insert bytes if data is already larger than maxLen.
Diffstat (limited to 'prog/mutation.go')
| -rw-r--r-- | prog/mutation.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/prog/mutation.go b/prog/mutation.go index 3a4c8cddb..dbb605041 100644 --- a/prog/mutation.go +++ b/prog/mutation.go @@ -465,7 +465,7 @@ var mutateDataFuncs = [...]func(r *randGen, data []byte, minLen, maxLen uint64) }, // Insert random bytes. func(r *randGen, data []byte, minLen, maxLen uint64) ([]byte, bool) { - if len(data) == 0 { + if len(data) == 0 || uint64(len(data)) >= maxLen { return data, false } n := r.Intn(16) + 1 |
