.

t/neo/marshal.go

@@ -1032,16 +1032,16 @@ func (p *AnswerLockedTransactions) NEODecode(data []byte) (int, error) {
 		l := binary.BigEndian.Uint32(data[0:])
 		data = data[4:]
 		nread += 4
+		if uint32(len(data)) < l*16 {
+			goto overflow
+		}
+		nread += l * 16
 		p.TidDict = make(map[Tid]Tid, l)
 		m := p.TidDict
 		for i := 0; uint32(i) < l; i++ {
-			if uint32(len(data)) < 16 {
-				goto overflow
-			}
 			key := Tid(binary.BigEndian.Uint64(data[0:]))
 			m[key] = Tid(binary.BigEndian.Uint64(data[8:]))
 			data = data[16:]
-			nread += 16
 		}
 	}
 	return 0 + int(nread), nil
@@ -2723,6 +2723,10 @@ func (p *AnswerObjectUndoSerial) NEODecode(data []byte) (int, error) {
 		l := binary.BigEndian.Uint32(data[0:])
 		data = data[4:]
 		nread += 4
+		if uint32(len(data)) < l*25 {
+			goto overflow
+		}
+		nread += l * 25
 		p.ObjectTIDDict = make(map[Oid]struct {
 			CurrentSerial Tid
 			UndoSerial    Tid
@@ -2730,9 +2734,6 @@ func (p *AnswerObjectUndoSerial) NEODecode(data []byte) (int, error) {
 		}, l)
 		m := p.ObjectTIDDict
 		for i := 0; uint32(i) < l; i++ {
-			if uint32(len(data)) < 25 {
-				goto overflow
-			}
 			key := Oid(binary.BigEndian.Uint64(data[0:]))
 			var v struct {
 				CurrentSerial Tid
@@ -2744,7 +2745,6 @@ func (p *AnswerObjectUndoSerial) NEODecode(data []byte) (int, error) {
 			v.IsCurrent = byte2bool((data[24:])[0])
 			m[key] = v
 			data = data[25:]
-			nread += 25
 		}
 	}
 	return 0 + int(nread), nil
@@ -2926,19 +2926,16 @@ func (p *CheckReplicas) NEODecode(data []byte) (int, error) {
 		l := binary.BigEndian.Uint32(data[0:])
 		data = data[4:]
 		nread += 4
+		if uint32(len(data)) < l*8 {
+			goto overflow
+		}
+		nread += l * 8
 		p.PartitionDict = make(map[uint32]UUID, l)
 		m := p.PartitionDict
 		for i := 0; uint32(i) < l; i++ {
-			if uint32(len(data)) < 8 {
-				goto overflow
-			}
 			key := binary.BigEndian.Uint32(data[0:])
 			m[key] = UUID(int32(binary.BigEndian.Uint32(data[4:])))
 			data = data[8:]
-			nread += 8
-		}
-		if uint32(len(data)) < 16 {
-			goto overflow
 		}
 	}
 	p.MinTID = Tid(binary.BigEndian.Uint64(data[0:]))

t/neo/protogen.go

@@ -608,9 +608,9 @@ func (d *decoder) genSlice(assignto string, typ *types.Slice, obj types.Object)
 
 	d.resetPos()
 
+	// if size(item)==const - check overflow in one go
 	elemSize, elemFixed := typeSizeFixed(typ.Elem())
-	// if size(item)==const - check l in one go
-	overflowChecked := d.overflowChecked
+	overflowCheckedCur := d.overflowChecked
 	if elemFixed {
 		d.overflowCheckpoint()
 		d.overflowCheckSize.AddExpr("l * %v", elemSize)
@@ -640,7 +640,7 @@ func (d *decoder) genSlice(assignto string, typ *types.Slice, obj types.Object)
 
 	d.emit("}")
 
-	d.overflowChecked = overflowChecked
+	d.overflowChecked = overflowCheckedCur
 
 	//d.emit("%v= string(data[:l])", assignto)
 	d.emit("}")
@@ -709,26 +709,27 @@ func (d *decoder) genMap(assignto string, typ *types.Map, obj types.Object) {
 	d.emit("{")
 	d.genBasic("l:", types.Typ[types.Uint32], nil)
 
-/*
-	d.emit("data = data[%v:]", d.pos.num)
-	d.emit("%v += %v", d.var_("nread"), d.pos.num)
-	d.flushOverflow()
-	d.pos = size{}	// zero
-*/
-	d.overflowCheckpoint()
 	d.resetPos()
 
-	//d.pos.AddExpr("l")
+	// if size(key,item)==const - check overflow in one go
+	keySize, keyFixed := typeSizeFixed(typ.Key())
+	elemSize, elemFixed := typeSizeFixed(typ.Elem())
+	itemFixed := keyFixed && elemFixed
+	if itemFixed {
+		d.overflowCheckpoint()
+		d.overflowCheckSize.AddExpr("l * %v", keySize + elemSize)
+		d.overflowChecked = true
+
+		d.emit("%v += l * %v", d.var_("nread"), keySize + elemSize)
+	}
 
 	d.emit("%v= make(%v, l)", assignto, typeName(typ))
-	// TODO size check
-	// TODO if size(item)==const - check l in one go
-	//d.emit("if len(data) < l { goto overflow }")
 	d.emit("m := %v", assignto)
 	d.emit("for i := 0; uint32(i) < l; i++ {")
 
-	d.overflowCheckpoint()
-	d.resetPos()
+	if !itemFixed {
+		d.overflowCheckpoint()
+	}
 
 	codegenType("key:", typ.Key(), obj, d)
 
@@ -745,7 +746,15 @@ func (d *decoder) genMap(assignto string, typ *types.Map, obj types.Object) {
 		d.emit("m[key] = v")
 	}
 
-	d.resetPos()
+	// d.resetPos() with nread update optionally skipped
+	if d.n != 0 {
+		d.emit("data = data[%v:]", d.n)
+		if !elemFixed {
+			d.emit("%v += %v", d.var_("nread"), d.n)
+		}
+		d.n = 0
+	}
+
 	d.emit("}")
 
 	d.overflowCheckpoint()