Merge pull request #63 from masatake/fix-integer-overflow

Fix an integer overflow occurring when a tag has too many fields

Author: masatake

.gitignore

@@ -41,6 +41,7 @@ tests/test-api-tagsOpen
 tests/test-api-tagsSetSortType
 tests/test-fix-large-tags
 tests/test-fix-null-deref
+tests/test-fix-too-many-fields
 tests/test-fix-unescaping
 tests/test-fix-unescaping-input-fields
 tests/test-fix-unescaping-input-fields-exuberant

NEWS.md

@@ -17,6 +17,11 @@
 		4.67user 0.19system 0:04.89elapsed 99%CPU (0avgtext+0avgdata 2819612maxresident)k
 		0inputs+0outputs (0major+44137minor)pagefaults 0swaps
 		```
+- fix an integer overflow occurring when a tag has too many fields.
+
+  The original issue was reported by Arthur Chan
+  <arthur.chan@adalogics.com> from Ada Logics in collaboration with
+  Claude and Anthropic Research.
 
 # Version 0.4.0
 

readtags.c

@@ -421,7 +421,15 @@ static tagResult growFields (tagFile *const file)
 {
 	tagResult result = TagFailure;
 	unsigned short newCount = (unsigned short) 2 * file->fields.max;
-	tagExtensionField *newFields = (tagExtensionField*)
+	tagExtensionField *newFields;
+
+	if (!(newCount > file->fields.max)) {
+		errno = EOVERFLOW;
+		perror ("too many extension fields");
+		goto out;				/* integer overflow */
+	}
+
+	newFields = (tagExtensionField*)
 			realloc (file->fields.list, newCount * sizeof (tagExtensionField));
 	if (newFields == NULL)
 		perror ("too many extension fields");
@@ -431,6 +439,8 @@ static tagResult growFields (tagFile *const file)
 		file->fields.max = newCount;
 		result = TagSuccess;
 	}
+
+ out:
 	return result;
 }
 
@@ -513,7 +523,7 @@ static tagResult parseExtensionFields (tagFile *const file, tagEntry *const entr
 					{
 						if (growFields (file) != TagSuccess)
 						{
-							*err = ENOMEM;
+							*err = errno;
 							return TagFailure;
 						}
 					}

tests/Makefile.am

@@ -16,6 +16,7 @@ TESTS = \
 	test-fix-unescaping-input-fields-no-mode \
 	test-fix-unescaping-input-fields-backslash \
 	test-fix-unescaping-input-fields-no-filesep \
+	test-fix-too-many-fields \
 	\
 	$(NULL)
 
@@ -37,6 +38,7 @@ check_PROGRAMS = \
 	test-fix-unescaping-input-fields-no-mode \
 	test-fix-unescaping-input-fields-backslash \
 	test-fix-unescaping-input-fields-no-filesep \
+	test-fix-too-many-fields \
 	\
 	$(NULL)
 
@@ -120,3 +122,7 @@ EXTRA_DIST += unescaping-input-fields-backslash.tags
 test_fix_unescaping_input_fields_no_filesep = test-fix-unescaping-input-fields-no-filesep.c
 test_fix_unescaping_input_fields_no_filesep_DEPENDENCIES = $(DEPS)
 EXTRA_DIST += unescaping-input-fields-no-filesep.tags
+
+test_fix_too_many_fields = test-fix-too-many-fields.c
+test_fix_too_many_fields_DEPENDENCIES = $(DEPS)
+EXTRA_DIST += too-many-fields.tags

tests/test-fix-too-many-fields.c

@@ -0,0 +1,74 @@
+/*
+*   Copyright (c) 2026, Masatake YAMATO
+*
+*   This source code is released into the public domain.
+*
+*   Testing the fix for handling unescaping
+*/
+
+#include "readtags.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+
+int
+main (void)
+{
+	char *srcdir = getenv ("srcdir");
+	if (srcdir)
+	{
+		if (chdir (srcdir) == -1)
+		{
+			perror ("chdir");
+			return 99;
+		}
+	}
+
+	tagFile *t;
+	tagFileInfo info;
+
+	const char *tags0 = "./too-many-fields.tags";
+	t = tagsOpen (tags0, &info);
+	if (t == NULL
+		|| info.status.opened == 0)
+	{
+		fprintf (stderr, "unexpected result (t: %p, opened: %d)\n",
+				 t, info.status.opened);
+		return 1;
+	}
+	fprintf (stderr, "ok\n");
+
+	tagEntry e;
+	tagResult r;
+	int err;
+
+	r = tagsFirst (t, &e);
+	if (r != TagFailure)
+	{
+		fprintf (stderr, "unexpected successful returned from tagsFirst\n");
+		return 1;
+	}
+
+	err = tagsGetErrno (t);
+	if (err != EOVERFLOW)
+	{
+		if (err > 0)
+		{
+			errno = err;
+			perror("tagsFirst");
+		}
+		fprintf (stderr, "unexpected errno returned from tagsFirst: %d\n", err);
+		return 1;
+	}
+
+	r = tagsClose(t);
+	if (r != TagSuccess)
+	{
+		fprintf (stderr, "error in tagsClose\n");
+		return 1;
+	}
+
+	return 0;
+}