From e021ba591a8e9c924506343fd263dc0dfeb0457b Mon Sep 17 00:00:00 2001 From: Georges Berenger Date: Thu, 21 Nov 2024 22:47:37 -0800 Subject: [PATCH] [vrs} Relax limit on datalayout content blocks Summary: In D66209820, we introduced a sanity check on datalayout sizes to make our fuzzer happy. However, we do have incredibly large archives that go beyond these limits. This diff increases the tolerance for huge varsize datalaout sections to what can actually fit in a record. Reviewed By: finik Differential Revision: D66338418 fbshipit-source-id: 8426ba613957bd78dc78cb292ed3f43078e10939 --- vrs/ContentBlockReader.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/vrs/ContentBlockReader.cpp b/vrs/ContentBlockReader.cpp index 0564007b..f8f67c27 100644 --- a/vrs/ContentBlockReader.cpp +++ b/vrs/ContentBlockReader.cpp @@ -20,6 +20,7 @@ #include #include +#include #include #include #include @@ -439,11 +440,12 @@ bool DataLayoutBlockReader::readBlock( // The size of the variable size buffer can be read from the var size index, so we read // the fixed size buffer first, extract the size of the var size data from the var size index, // so we can then read the var size buffer... - const size_t kMaxDataSize = 1024 * 1024 * 1024; // 1GB + const size_t kMaxFixedDataSize = 1024 * 1024 * 1024; // 1GB, arbitrary limit + const size_t kMaxRecordSize = 4 * 1024 * 1024 * 1024UL - sizeof(FileFormat::RecordHeader); DataLayout& layout = *blockLayout_; vector& fixedData = layout.getFixedData(); size_t fixedDataSize = layout.getFixedDataSizeNeeded(); - if (!XR_VERIFY(fixedDataSize <= kMaxDataSize)) { + if (!XR_VERIFY(fixedDataSize <= kMaxFixedDataSize)) { return false; } fixedData.resize(fixedDataSize); @@ -451,7 +453,7 @@ bool DataLayoutBlockReader::readBlock( int readBlockStatus = record.reader->read(fixedData); if (readBlockStatus == 0) { size_t varDataSize = layout.getVarDataSizeFromIndex(); - if (!XR_VERIFY(varDataSize <= kMaxDataSize)) { + if (!XR_VERIFY(fixedDataSize + varDataSize <= kMaxRecordSize)) { return false; } varData.resize(varDataSize);