protect agains potential panic

ndyakov · ndyakov · commit 1329d105f0dc · 2026-06-11T09:30:25.000+03:00
diff --git a/internal/proto/peek_push_notification_test.go b/internal/proto/peek_push_notification_test.go
@@ -4,7 +4,9 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"math"
 	"math/rand"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -758,3 +760,25 @@ func TestPeekPushNotificationName_EmptyArrayLength(t *testing.T) {
 		t.Fatalf("PeekPushNotificationName: error should mention empty array length, got %v", err)
 	}
 }
+
+// TestPeekPushNotificationName_OverflowingNameLength asserts that a frame
+// advertising a name length near math.MaxInt does not panic. Computing
+// next+nameLen would overflow int and wrap negative, slipping past a naive
+// "end > len(buf)" guard and panicking the backing slice; the parser must
+// instead treat it as incomplete and surface an error without crashing.
+func TestPeekPushNotificationName_OverflowingNameLength(t *testing.T) {
+	data := []byte(">1\r\n$" + strconv.Itoa(math.MaxInt) + "\r\n")
+	rd := NewReader(bytes.NewReader(data))
+
+	if _, err := rd.PeekReplyType(); err != nil {
+		t.Fatalf("PeekReplyType: %v", err)
+	}
+
+	name, err := rd.PeekPushNotificationName()
+	if err == nil {
+		t.Fatalf("PeekPushNotificationName: want error for overflowing name length, got name=%q", name)
+	}
+	if name != "" {
+		t.Fatalf("PeekPushNotificationName: want empty name on error, got %q", name)
+	}
+}
diff --git a/internal/proto/reader.go b/internal/proto/reader.go
@@ -219,11 +219,15 @@ func parsePushNotificationName(buf []byte) (string, bool, error) {
 		if nameLen < 0 {
 			return "", false, fmt.Errorf("redis: negative push notification name length: %d", nameLen)
 		}
-		end := next + nameLen
-		if end > len(buf) {
+		// Compare against the remaining bytes instead of computing
+		// next+nameLen: a hugely advertised length on malformed input could
+		// overflow int, wrap negative, slip past an "end > len(buf)" guard and
+		// panic the slice below. next <= len(buf) here, so the subtraction is
+		// safe.
+		if nameLen > len(buf)-next {
 			return "", false, nil
 		}
-		return util.BytesToString(buf[next:end]), true, nil
+		return util.BytesToString(buf[next : next+nameLen]), true, nil
 	}
 
 	// RespStatus: scan for the terminating CRLF.

Original file line number	Diff line number	Diff line change
`@@ -219,11 +219,15 @@ func parsePushNotificationName(buf []byte) (string, bool, error) {`
`219`	`219`	`if nameLen < 0 {`
`220`	`220`	`return "", false, fmt.Errorf("redis: negative push notification name length: %d", nameLen)`
`221`	`221`	`}`
`222`		`- end := next + nameLen`
`223`		`- if end > len(buf) {`
	`222`	`+ // Compare against the remaining bytes instead of computing`
	`223`	`+ // next+nameLen: a hugely advertised length on malformed input could`
	`224`	`+ // overflow int, wrap negative, slip past an "end > len(buf)" guard and`
	`225`	`+ // panic the slice below. next <= len(buf) here, so the subtraction is`
	`226`	`+ // safe.`
	`227`	`+ if nameLen > len(buf)-next {`
`224`	`228`	`return "", false, nil`
`225`	`229`	`}`
`226`		`- return util.BytesToString(buf[next:end]), true, nil`
	`230`	`+ return util.BytesToString(buf[next : next+nameLen]), true, nil`
`227`	`231`	`}`
`228`	`232`
`229`	`233`	`// RespStatus: scan for the terminating CRLF.`