Prevent 32-bit size_t integer overflow in absl::CEscape PiperOrigin-RevId: 946022039 Change-Id: Id3ad9b9e1a332d81d1322fa92d6c3a419fd48483
diff --git a/absl/strings/escaping.cc b/absl/strings/escaping.cc index bdbc7ce..1ed7c24 100644 --- a/absl/strings/escaping.cc +++ b/absl/strings/escaping.cc
@@ -459,10 +459,10 @@ // We keep 3 slop bytes so that we can call `little_endian::Store32` // invariably regardless of the length of the escaped character. constexpr size_t kSlopBytes = 3; - size_t cur_dest_len = dest->size(); - size_t append_buf_len = cur_dest_len + escaped_len + kSlopBytes; - ABSL_INTERNAL_CHECK(append_buf_len > cur_dest_len, - "std::string size overflow"); + ABSL_INTERNAL_CHECK( + escaped_len <= std::numeric_limits<size_t>::max() - kSlopBytes, + "CEscape length overflow"); + size_t append_buf_len = escaped_len + kSlopBytes; strings_internal::StringAppendAndOverwrite( *dest, append_buf_len, [src, escaped_len](char* append_ptr, size_t) { for (char c : src) {