fix review: add SWIG declarations, input validation, 32-bit safe decoding

Author: ppomes

coraza.i

@@ -401,3 +401,10 @@ extern int coraza_free_waf(coraza_waf_t t);
 extern coraza_severity_t coraza_matched_rule_get_severity(
     coraza_matched_rule_t r);
 extern char *coraza_matched_rule_get_error_log(coraza_matched_rule_t r);
+extern int coraza_add_request_headers(coraza_transaction_t t,
+                                      const char *packed, int packed_len,
+                                      int count);
+extern int coraza_add_response_headers(coraza_transaction_t t,
+                                       const char *packed, int packed_len,
+                                       int count);
+extern void coraza_free_string(char *s);

libcoraza/coraza.go

@@ -286,14 +286,17 @@ func coraza_add_request_header(t C.coraza_transaction_t, name *C.char, name_len
 //
 //export coraza_add_request_headers
 func coraza_add_request_headers(t C.coraza_transaction_t, packed *C.char, packed_len C.int, count C.int) C.int {
+	if packed_len < 0 || count < 0 {
+		return -1
+	}
 	tx := fromRaw[types.Transaction](t)
 	buf := C.GoBytes(unsafe.Pointer(packed), packed_len)
 	off := 0
 	for i := 0; i < int(count); i++ {
 		if off+2 > len(buf) {
 			return -1
 		}
-		nameLen := int(buf[off])<<8 | int(buf[off+1])
+		nameLen := int(uint16(buf[off])<<8 | uint16(buf[off+1]))
 		off += 2
 		if off+nameLen > len(buf) {
 			return -1
@@ -303,7 +306,7 @@ func coraza_add_request_headers(t C.coraza_transaction_t, packed *C.char, packed
 		if off+4 > len(buf) {
 			return -1
 		}
-		valueLen := int(buf[off])<<24 | int(buf[off+1])<<16 | int(buf[off+2])<<8 | int(buf[off+3])
+		valueLen := int(uint32(buf[off])<<24 | uint32(buf[off+1])<<16 | uint32(buf[off+2])<<8 | uint32(buf[off+3]))
 		off += 4
 		if off+valueLen > len(buf) {
 			return -1
@@ -359,14 +362,17 @@ func coraza_add_response_header(t C.coraza_transaction_t, name *C.char, name_len
 //
 //export coraza_add_response_headers
 func coraza_add_response_headers(t C.coraza_transaction_t, packed *C.char, packed_len C.int, count C.int) C.int {
+	if packed_len < 0 || count < 0 {
+		return -1
+	}
 	tx := fromRaw[types.Transaction](t)
 	buf := C.GoBytes(unsafe.Pointer(packed), packed_len)
 	off := 0
 	for i := 0; i < int(count); i++ {
 		if off+2 > len(buf) {
 			return -1
 		}
-		nameLen := int(buf[off])<<8 | int(buf[off+1])
+		nameLen := int(uint16(buf[off])<<8 | uint16(buf[off+1]))
 		off += 2
 		if off+nameLen > len(buf) {
 			return -1
@@ -376,7 +382,7 @@ func coraza_add_response_headers(t C.coraza_transaction_t, packed *C.char, packe
 		if off+4 > len(buf) {
 			return -1
 		}
-		valueLen := int(buf[off])<<24 | int(buf[off+1])<<16 | int(buf[off+2])<<8 | int(buf[off+3])
+		valueLen := int(uint32(buf[off])<<24 | uint32(buf[off+1])<<16 | uint32(buf[off+2])<<8 | uint32(buf[off+3]))
 		off += 4
 		if off+valueLen > len(buf) {
 			return -1