tree 5b2e66b1e375455b125eda3dd43b1718c73b5b46
parent 929c17cf481222c35ff1652498994871120e832a
author Derek Mauro <761129+derekmauro@users.noreply.github.com> 1737643863 -0500
committer GitHub <noreply@github.com> 1737643863 -0500
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJnkldXCRC1aQ7uu5UhlAAA/CYQAGhMSLG7ghoVgqmNTgdfFPfe
 yq6sMd3457lw2REs+AuQSFIw9idGswlmgANJB5mCfopllyO81CdEgi0lOljWATU7
 3Qiguc4Dpikfo5pY8jjy4oikTg0U9dJaNJEE0M2DhujximWAbdKDD4FEG7Ql9cR4
 vvIvh59zeTcOpUb3ySUX9sBZUAf2Z9XTf1xVQrXgg9fj4A9pE8z7pBGFHUaXBoh0
 pUuCOmjYUQgKeMNKy5XbEH1yr0R7DkADKqW9Qsglpw5LU3kL56zxUHdtBocThV7V
 cifhPOsJRpWJpIHYA35DbNfBGlK6KbblraFrltSmNyDFfx5L4JB7a9ZLhTwdDf8K
 F6q/0xEiTkROM8gFypvc8TANvFnx+ZtzpZADN2Y3P0mG8j3cGe9TknhFRSLPObbC
 Pg+wU+MuZV1AgH8y2lsjaYrx/CYtTf5wmgK6GfaMJrYP1hvHdINFXGqBf8NuWvea
 7XKExswhUQ94x36Ro7KFxUvfXvL3devVg2zFg+KnIH6s5HXC7o5zl+ALaY3k4m67
 3tVGD6ZrO2sue9y63Z/IpxLeAplfp82Gi92XwL1f4TcBBDyILceuPDHGaDeOcT91
 4x+VoJaxz7RaZXLhTiOD7zydS6GWhZkMWgmi22PTT6K2xpwNHqU2T23A5QNqfL+d
 bGJCMLjGPJw3jzJUnkOG
 =qwmF
 -----END PGP SIGNATURE-----
 

Fix potential integer overflow in hash container create/resize (#1813)

The sized constructors, reserve(), and rehash() methods of
absl::{flat,node}_hash_{set,map} did not impose an upper bound on
their size argument. As a result, it was possible for a caller to pass
a very large size that would cause an integer overflow when computing
the size of the container's backing store. Subsequent accesses to the
container might then access out-of-bounds memory.

The fix is in two parts:

1) Update max_size() to return the maximum number of items that can be
stored in the container

2) Validate the size arguments to the constructors, reserve(), and
rehash() methods, and abort the program when the argument is invalid

We've looked at uses of these containers in Google codebases like
Chrome, and determined this vulnerability is likely to be difficult to
exploit. This is primarily because container sizes are rarely
attacker-controlled.

The bug was discovered by Dmitry Vyukov <dvyukov@google.com>.