Skip to content

Fixed enum selector bounds checks to prevent validation bypass and JSON panic(issue #6787 )#6788

Closed
mateeaaaaaaa wants to merge 1 commit intobrimdata:mainfrom
mateeaaaaaaa:main
Closed

Fixed enum selector bounds checks to prevent validation bypass and JSON panic(issue #6787 )#6788
mateeaaaaaaa wants to merge 1 commit intobrimdata:mainfrom
mateeaaaaaaa:main

Conversation

@mateeaaaaaaa
Copy link
Copy Markdown

@mateeaaaaaaa mateeaaaaaaa commented Apr 1, 2026

Summary

This PR fixes enum selector validation and conversion paths that could mis-handle large unsigned values after signed conversion.

Specifically, it addresses issue #6787 by:

  • fixing enum validation to use unsigned bounds checks,
  • fixing JSON enum conversion to avoid negative index panic,
  • hardening JSUP enum decode to reject negative and out-of-range indexes.

Closes #6787.

What Changed

  • value.go
    • Updated enum selector bounds check in checkEnum to compare uint64 values directly.
  • sio/jsonio/writer.go
    • Updated convertEnum to avoid int conversion before indexing and safely return "" for invalid selectors.
  • sio/jsupio/reader.go
    • Added explicit validation in decodeEnum for:
      • negative indexes,
      • out-of-range indexes.

Tests Added

  • value_test.go
    • Added regression test ensuring Validate rejects enum selector math.MaxUint64.
  • sio/jsonio/writer_test.go
    • Added regression test ensuring out-of-range enum selector does not panic during JSON write and renders "".
  • sio/jsupio/reader_test.go
    • Added tests ensuring JSUP enum decode rejects negative and out-of-range indexes.

Verification

Commands run:

  • go test .
  • go test ./sio/jsonio ./sio/jsupio

Results:

  • All tests passed.

Risk / Compatibility

  • Low risk: changes are localized to enum selector validation and conversion paths.
  • No API surface changes.
  • Behavior for malformed enum selectors is now safe and explicit (error or "") instead of panic/acceptance.

@nwt nwt closed this Apr 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Enum selector signed/unsigned conversion bypasses validation and can panic JSON serialization

2 participants