msgpack, struct, zlib, buffer_helper: values from outside used unchecked

shared-bindings/zlib/__init__.c

@@ -53,7 +53,7 @@
 static mp_obj_t zlib_decompress(size_t n_args, const mp_obj_t *args) {
     mp_int_t wbits = 0;
     if (n_args > 1) {
-        wbits = MP_OBJ_SMALL_INT_VALUE(args[1]);
+        wbits = mp_obj_get_int_truncated(args[1]);
     }
 
     return common_hal_zlib_decompress(args[0], wbits);

shared-module/msgpack/__init__.c

@@ -9,6 +9,7 @@
 
 #include "py/obj.h"
 #include "py/binary.h"
+#include "py/cstack.h"
 #include "py/objarray.h"
 #include "py/objlist.h"
 #include "py/objstringio.h"
@@ -254,6 +255,7 @@ static void pack_dict(msgpack_stream_t *s, size_t len) {
 }
 
 static void pack(mp_obj_t obj, msgpack_stream_t *s, mp_obj_t default_handler) {
+    mp_cstack_check();
     if (mp_obj_is_small_int(obj)) {
         // int
         int32_t x = MP_OBJ_SMALL_INT_VALUE(obj);
@@ -293,11 +295,11 @@ static void pack(mp_obj_t obj, msgpack_stream_t *s, mp_obj_t default_handler) {
             pack(next->value, s, default_handler);
         }
     } else if (mp_obj_is_float(obj)) {
-        union Float { mp_float_t f;
+        union Float { float f;
                       uint32_t u;
         };
         union Float data;
-        data.f = mp_obj_float_get(obj);
+        data.f = (float)mp_obj_float_get(obj);
         write1(s, 0xca);
         write4(s, data.u);
     } else if (obj == mp_const_none) {
@@ -326,7 +328,14 @@ static void pack(mp_obj_t obj, msgpack_stream_t *s, mp_obj_t default_handler) {
 
 static mp_obj_t unpack(msgpack_stream_t *s, mp_obj_t ext_hook, bool use_list);
 
+static void check_container_size(size_t count, size_t elem_size, qstr name) {
+    if (count > SIZE_MAX / elem_size) {
+        mp_raise_ValueError_varg(MP_ERROR_TEXT("%q too long"), name);
+    }
+}
+
 static mp_obj_t unpack_array_elements(msgpack_stream_t *s, size_t size, mp_obj_t ext_hook, bool use_list) {
+    check_container_size(size, sizeof(mp_obj_t), MP_QSTR_array);
     if (use_list) {
         mp_obj_list_t *t = MP_OBJ_TO_PTR(mp_obj_new_list(size, NULL));
         for (size_t i = 0; i < size; i++) {
@@ -372,6 +381,7 @@ static mp_obj_t unpack_ext(msgpack_stream_t *s, size_t size, mp_obj_t ext_hook)
 }
 
 static mp_obj_t unpack(msgpack_stream_t *s, mp_obj_t ext_hook, bool use_list) {
+    mp_cstack_check();
     uint8_t code = read1(s);
     if (((code & 0b10000000) == 0) || ((code & 0b11100000) == 0b11100000)) {
         // int
@@ -431,12 +441,12 @@ static mp_obj_t unpack(msgpack_stream_t *s, mp_obj_t ext_hook, bool use_list) {
             return mp_obj_new_int_from_ll((int64_t)read8(s));
         case 0xca: { // float
             union Float {
-                mp_float_t f;
+                float f;
                 uint32_t u;
             };
             union Float data;
             data.u = read4(s);
-            return mp_obj_new_float(data.f);
+            return mp_obj_new_float((mp_float_t)data.f);
         }
         case 0xcb: { // double
             union Double {
@@ -462,6 +472,7 @@ static mp_obj_t unpack(msgpack_stream_t *s, mp_obj_t ext_hook, bool use_list) {
         case 0xdf: {
             // map 16 & 32
             size_t len = read_size(s, code - 0xde + 1);
+            check_container_size(len, sizeof(mp_map_elem_t), MP_QSTR_map);
             mp_obj_dict_t *d = MP_OBJ_TO_PTR(mp_obj_new_dict(len));
             for (size_t i = 0; i < len; i++) {
                 mp_obj_t key = unpack(s, ext_hook, use_list);

shared-module/struct/__init__.c

@@ -47,7 +47,7 @@ static mp_uint_t get_fmt_num(const char **p) {
     while (unichar_isdigit(*++num)) {
         len++;
     }
-    mp_uint_t val = (mp_uint_t)MP_OBJ_SMALL_INT_VALUE(mp_parse_num_integer(*p, len, 10, NULL));
+    mp_uint_t val = (mp_uint_t)mp_obj_get_int(mp_parse_num_integer(*p, len, 10, NULL));
     *p = num;
     return val;
 }

shared/runtime/buffer_helper.c

@@ -14,6 +14,9 @@ void normalize_buffer_bounds(int32_t *start, int32_t end, size_t *length) {
     }
     if (*start < 0) {
         *start += *length;
+        if (*start < 0) {
+            *start = 0;
+        }
     }
     if (end < *start) {
         *length = 0;