From e7294c631ffe78d79628043e6056a7c92681bbe4 Mon Sep 17 00:00:00 2001
From: Ben McClelland <ben.mcclelland@versity.com>
Date: Mon, 5 May 2025 16:36:29 -0700
Subject: [PATCH] fix: add bounds check for ContentLength type conversion

On 32-bit systems, this value could overflow. Add a check for the
overflow and return ErrInvalidRange if it does overflow.

The type in GetObjectOutput for ContentLength is *int64, but the
fasthttp.RequestCtx.SetBodyStream() takes type int. So there is
no way to set the bodysize to the correct limit if the value
overflows.
---
 s3api/controllers/base.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/s3api/controllers/base.go b/s3api/controllers/base.go
index 254d2f4f..c1df2bbb 100644
--- a/s3api/controllers/base.go
+++ b/s3api/controllers/base.go
@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -675,6 +676,17 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error {
 		// -1 will stream response body until EOF if content length not set
 		contentLen := -1
 		if res.ContentLength != nil {
+			if *res.ContentLength > int64(math.MaxInt) {
+				debuglogger.Logf("content length %v int overflow",
+					*res.ContentLength)
+				return SendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidRange),
+					&MetaOpts{
+						Logger:      c.logger,
+						MetricsMng:  c.mm,
+						Action:      metrics.ActionGetObject,
+						BucketOwner: parsedAcl.Owner,
+					})
+			}
 			contentLen = int(*res.ContentLength)
 		}
 		utils.StreamResponseBody(ctx, res.Body, contentLen)