Avoid negative indexes on array-accesses.

Found via fuzzing :)
skx · Dec 22, 2018 · 8ec555e · 8ec555e
1 parent 114562c
commit 8ec555e
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/object/object.go b/object/object.go
@@ -88,14 +88,17 @@ func Array(x int, y int) *ArrayObject {
 
 // Get the value at the given X,Y coordinate
 func (a *ArrayObject) Get(x int, y int) Object {
-	offset := x*a.X + y
+	offset := int(x*a.X + y)
 
 	if a.X == 0 && offset >= a.Y {
 		return &ErrorObject{Value: "Get-Array access out of bounds (Y)"}
 	}
 	if (a.X != 0) && (offset > a.X*a.Y) {
 		return &ErrorObject{Value: "Get-Array access out of bounds (X,Y)"}
 	}
+	if offset < 0 {
+		return &ErrorObject{Value: "Get-Array access out of bounds (negative index)"}
+	}
 	if offset > len(a.Contents) {
 		return &ErrorObject{Value: "Get-Array access out of bounds (LEN)"}
 	}
@@ -104,14 +107,17 @@ func (a *ArrayObject) Get(x int, y int) Object {
 
 // Set the value at the given X,Y coordinate
 func (a *ArrayObject) Set(x int, y int, obj Object) Object {
-	offset := x*a.X + y
+	offset := int(x*a.X + y)
 
 	if a.X == 0 && offset >= a.Y {
 		return &ErrorObject{Value: "Set-Array access out of bounds (Y)"}
 	}
 	if (a.X != 0) && (offset > a.X*a.Y) {
 		return &ErrorObject{Value: "Set-Array access out of bounds (X,Y)"}
 	}
+	if offset < 0 {
+		return &ErrorObject{Value: "Set-Array access out of bounds (negative index)"}
+	}
 	if offset > len(a.Contents) {
 		return &ErrorObject{Value: "Set-Array access out of bounds (LEN)"}
 	}

diff --git a/object/object_test.go b/object/object_test.go
@@ -133,6 +133,19 @@ func Test1DArray(t *testing.T) {
 	if err2.Type() != ERROR {
 		t.Errorf("Expected a bounds-error, got none")
 	}
+
+	// Test that we have negative bound-checking on Get
+	err3 := a.Get(0, -6)
+	if err3.Type() != ERROR {
+		t.Errorf("Expected a bounds-error, got none")
+	}
+
+	// Test that we have negative bound-checking on Set
+	err4 := a.Set(0, -6, err1)
+	if err4.Type() != ERROR {
+		t.Errorf("Expected a bounds-error, got none")
+	}
+
 }
 
 func Test2DArray(t *testing.T) {