avoid signed overflow in cache memory limit by metsw24-max · Pull Request #4561 · lovell/sharp

metsw24-max · 2026-06-25T17:23:05Z

sharp.cache({ memory }) passes the megabyte value through to the native cache helper, which reads it as a 32-bit int and multiplies by 1048576 to convert to bytes before handing the result to vips_cache_set_max_mem. The multiply runs in 32-bit signed arithmetic and only widens to the size_t the function expects afterwards, so any value of 2048 or above overflows first. A 2048MB request wraps to a negative number that sign-extends to roughly 16 exabytes, which leaves the operation cache effectively unbounded, while exactly 4096MB wraps to zero and silently disables it. I came across this while confirming that larger cache limits were honoured and saw the reported memory.max had no relation to the value passed in. Casting the operand to size_t before the multiply keeps the conversion in 64-bit so the byte count stays correct across the documented range. I have limited the change to that one expression and added a regression test at 4096MB, which reported a maximum of zero beforehand.

lovell · 2026-06-25T20:05:59Z

Thanks for the PR. Whilst we're fixing this, I think we might also want to use Uint32Value instead of Int32Value for the cache values as they should all be positive integers. I guess we could also verify these values in the JavaScript layer.

metsw24-max · 2026-06-26T09:13:10Z

Makes sense. Switched all three cache values to Uint32Value. I kept the size_t widening on memory because Uint32Value on its own still does the MB-to-bytes multiply in 32-bit and wraps from 4096MB up.

Also added a guard in lib/utility.mjs that rejects any cache value that isn't a non-negative integer, with a test for it. All squashed into the one commit.

lovell · 2026-06-26T13:57:58Z

Thanks for the updates, it looks like we might have to skip the max memory test on 32-bit systems. The buildPlatformArch() function should provide a suitable value for this.

Read the cache values as unsigned integers and keep the megabyte to byte conversion in size_t, so the memory limit no longer wraps at 2048MB and above. Reject non-integer and negative values in the JavaScript layer.

metsw24-max · 2026-06-26T15:22:01Z

Good shout. The 4096MB byte count overflows a 32-bit size_t too, so I now skip that test when buildPlatformArch() reports a 32-bit arch (arm, ia32, wasm32). Runs as before on 64-bit and skips cleanly when I force npm_config_arch=ia32.

lovell · 2026-06-26T16:32:05Z

Thank you. (The wasm32 test failure is unrelated, I'm fixing this now.)

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [sharp](https://sharp.pixelplumbing.com) ([source](https://github.com/lovell/sharp), [changelog](https://github.com/lovell/sharp/blob/main/docs/src/content/docs/changelog.md)) | [`0.35.2` → `0.35.3`](https://renovatebot.com/diffs/npm/sharp/0.35.2/0.35.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/sharp/0.35.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sharp/0.35.2/0.35.3?slim=true) | --- ### Release Notes <details> <summary>lovell/sharp (sharp)</summary> ### [`v0.35.3`](https://github.com/lovell/sharp/releases/tag/v0.35.3) [Compare Source](lovell/sharp@v0.35.2...v0.35.3) - Tighten verification of `text` dimensions, TIFF tile dimensions and `extend` values. - Improve code bundler support by resolving path to libvips binary. - Increase default concurrency when use of `MALLOC_ARENA_MAX` is detected. - Emit warning about binaries provided by Electron for use on Linux. - Add `hasAlpha` property to output `info`. [#4500](lovell/sharp#4500) - TypeScript: Return more precise `Buffer<ArrayBuffer>` from `toBuffer`. [#4520](lovell/sharp#4520) [@Andarist](https://github.com/Andarist) - Bound `clahe` width and height to avoid signed overflow. [#4551](lovell/sharp#4551) [@metsw24-max](https://github.com/metsw24-max) - Bound `trim` margin to avoid signed overflow. [#4552](lovell/sharp#4552) [@metsw24-max](https://github.com/metsw24-max) - Reject infinite values when validating numbers. [#4553](lovell/sharp#4553) [@metsw24-max](https://github.com/metsw24-max) - Bound extract region to libvips coordinate limit. [#4555](lovell/sharp#4555) [@metsw24-max](https://github.com/metsw24-max) - Verify background colour values are numbers. [#4556](lovell/sharp#4556) [@metsw24-max](https://github.com/metsw24-max) - Bound create and raw input dimensions to coordinate limit. [#4558](lovell/sharp#4558) [@metsw24-max](https://github.com/metsw24-max) - Tighten recomb and affine matrix verification. [#4560](lovell/sharp#4560) [@chatman-media](https://github.com/chatman-media) - Verify cache memory limit to avoid overflow. [#4561](lovell/sharp#4561) [@metsw24-max](https://github.com/metsw24-max) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

metsw24-max force-pushed the cache-memory-overflow branch from 76a3289 to 69a016f Compare June 26, 2026 09:12

avoid signed overflow in cache memory limit

6b3e1c7

Read the cache values as unsigned integers and keep the megabyte to byte conversion in size_t, so the memory limit no longer wraps at 2048MB and above. Reject non-integer and negative values in the JavaScript layer.

metsw24-max force-pushed the cache-memory-overflow branch from 69a016f to 6b3e1c7 Compare June 26, 2026 15:21

lovell merged commit bd0c2c7 into lovell:main Jun 26, 2026
31 of 32 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

avoid signed overflow in cache memory limit#4561

avoid signed overflow in cache memory limit#4561
lovell merged 1 commit into
lovell:mainfrom
metsw24-max:cache-memory-overflow

metsw24-max commented Jun 25, 2026

Uh oh!

lovell commented Jun 25, 2026

Uh oh!

metsw24-max commented Jun 26, 2026

Uh oh!

lovell commented Jun 26, 2026

Uh oh!

metsw24-max commented Jun 26, 2026

Uh oh!

Uh oh!

lovell commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

metsw24-max commented Jun 25, 2026

Uh oh!

lovell commented Jun 25, 2026

Uh oh!

metsw24-max commented Jun 26, 2026

Uh oh!

lovell commented Jun 26, 2026

Uh oh!

metsw24-max commented Jun 26, 2026

Uh oh!

Uh oh!

lovell commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants