Add missing bounds check to <FamStructWrapper as Versionize>::deserialize

CHANGELOG.md

@@ -1,3 +1,7 @@
+# v0.1.10
+
+- Fixed a possible out of bounds memory access in FamStructWrapper::deserialize
+
 # v0.1.9
 
 - Implement Versionize for i128 and u128

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "versionize"
-version = "0.1.9"
+version = "0.1.10"
 license = "Apache-2.0"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 description = "A version tolerant serialization/deserialization framework."

src/primitives.rs

@@ -369,6 +369,18 @@ where
         let entries: Vec<<T as FamStruct>::Entry> =
             Vec::deserialize(reader, version_map, app_version)
                 .map_err(|ref err| VersionizeError::Deserialize(format!("{:?}", err)))?;
+
+        if header.len() != entries.len() {
+            let msg = format!(
+                "Mismatch between length of FAM specified in FamStruct header ({}) \
+                and actual size of FAM ({})",
+                header.len(),
+                entries.len()
+            );
+
+            return Err(VersionizeError::Deserialize(msg));
+        }
+
         // Construct the object from the array items.
         // Header(T) fields will be initialized by Default trait impl.
         let mut object = FamStructWrapper::from_entries(&entries)

tests/test.rs

@@ -1323,6 +1323,32 @@ impl<T> Versionize for __IncompleteArrayField<T> {
 type MessageFamStructWrapper = FamStructWrapper<Message>;
 type Message2FamStructWrapper = FamStructWrapper<Message2>;
 
+#[test]
+fn test_deserialize_famstructwrapper_invalid_len() {
+    let mut vm = VersionMap::new();
+    vm.new_version()
+        .set_type_version(Message::type_id(), 2)
+        .new_version()
+        .set_type_version(Message::type_id(), 3)
+        .new_version()
+        .set_type_version(Message::type_id(), 4);
+
+    // Create FamStructWrapper with len 2
+    let state = MessageFamStructWrapper::new(0).unwrap();
+    let mut buffer = [0; 256];
+
+    state.serialize(&mut buffer.as_mut_slice(), &vm, 2).unwrap();
+
+    // the `len` field of the header is the first serialized field.
+    // Let's corrupt it by making it bigger than the actual number of serialized elements
+    buffer[0] = 255;
+
+    assert_eq!(
+        MessageFamStructWrapper::deserialize(&mut buffer.as_slice(), &vm, 2).unwrap_err(),
+        VersionizeError::Deserialize("Mismatch between length of FAM specified in FamStruct header (255) and actual size of FAM (0)".to_string())
+    );
+}
+
 #[test]
 fn test_versionize_famstructwrapper() {
     let mut vm = VersionMap::new();