From fe4c9dff767d69947dcb048ff5d2baa811e0b8a0 Mon Sep 17 00:00:00 2001 From: Ben McClelland Date: Tue, 4 Jun 2024 15:20:05 -0700 Subject: [PATCH] fix: part file bounds checks in posix --- backend/posix/posix.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/backend/posix/posix.go b/backend/posix/posix.go index 199e8bd..2d893e9 100644 --- a/backend/posix/posix.go +++ b/backend/posix/posix.go @@ -24,6 +24,7 @@ import ( "fmt" "io" "io/fs" + "math" "os" "path/filepath" "sort" @@ -992,7 +993,11 @@ func (p *Posix) ListParts(_ context.Context, input *s3.ListPartsInput) (s3respon var parts []s3response.Part for _, e := range ents { - pn, _ := strconv.Atoi(e.Name()) + pn, err := strconv.Atoi(e.Name()) + if err != nil { + // file is not a valid part file + continue + } if pn <= partNumberMarker { continue } @@ -1816,6 +1821,11 @@ func (p *Posix) GetObjectAttributes(ctx context.Context, input *s3.GetObjectAttr parts := []types.ObjectPart{} for _, p := range resp.Parts { + if !(p.PartNumber > 0 && p.PartNumber <= math.MaxInt32) { + return s3response.GetObjectAttributesResult{}, + s3err.GetAPIError(s3err.ErrInvalidPartNumber) + } + partNumber := int32(p.PartNumber) size := p.Size