Fix integer overflow in digest parsing (#211)

brandonweeks · web-flow · commit 31ad4f57fd00 · 2021-04-13T15:57:16.000-07:00
diff --git a/attest/eventlog.go b/attest/eventlog.go
@@ -712,7 +712,7 @@ func parseRawEvent2(r *bytes.Buffer, specID *specIDEvent) (event rawEvent, err e
 			if alg.ID != algID {
 				continue
 			}
-			if uint16(r.Len()) < alg.Size {
+			if r.Len() < int(alg.Size) {
 				return event, fmt.Errorf("reading digest: %v", io.ErrUnexpectedEOF)
 			}
 			digest.data = make([]byte, alg.Size)

Original file line number	Diff line number	Diff line change
`@@ -712,7 +712,7 @@ func parseRawEvent2(r bytes.Buffer, specID specIDEvent) (event rawEvent, err e`
`712`	`712`	`if alg.ID != algID {`
`713`	`713`	`continue`
`714`	`714`	`}`
`715`		`- if uint16(r.Len()) < alg.Size {`
	`715`	`+ if r.Len() < int(alg.Size) {`
`716`	`716`	`return event, fmt.Errorf("reading digest: %v", io.ErrUnexpectedEOF)`
`717`	`717`	`}`
`718`	`718`	`digest.data = make([]byte, alg.Size)`