From a33fe7e206d0c394440962acd360df3aa9b117c3 Mon Sep 17 00:00:00 2001 From: cuiweixie Date: Fri, 12 Aug 2022 20:22:21 +0800 Subject: [PATCH] net/http: don't panic on very large MaxBytesReaderLimit Fixes #54408 --- src/net/http/request.go | 3 ++- src/net/http/request_test.go | 6 ++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/net/http/request.go b/src/net/http/request.go index cead91d3d44..a5531fe4f94 100644 --- a/src/net/http/request.go +++ b/src/net/http/request.go @@ -1168,7 +1168,8 @@ func (l *maxBytesReader) Read(p []byte) (n int, err error) { // If they asked for a 32KB byte read but only 5 bytes are // remaining, no need to read 32KB. 6 bytes will answer the // question of the whether we hit the limit or go past it. - if int64(len(p)) > l.n+1 { + // 0 < len(p) < 2^63 + if int64(len(p))-1 > l.n { p = p[:l.n+1] } n, err = l.r.Read(p) diff --git a/src/net/http/request_test.go b/src/net/http/request_test.go index d285840c1ce..0f147845476 100644 --- a/src/net/http/request_test.go +++ b/src/net/http/request_test.go @@ -982,6 +982,12 @@ func TestMaxBytesReaderDifferentLimits(t *testing.T) { wantN: len(testStr), wantErr: false, }, + 10: { /* Issue 54408 */ + limit: int64(1<<63-1), + lenP: len(testStr), + wantN: len(testStr), + wantErr: false, + }, } for i, tt := range tests { rc := MaxBytesReader(nil, io.NopCloser(strings.NewReader(testStr)), tt.limit)