Fix integer overflow

Author: schungx

CHANGELOG.md

@@ -1,6 +1,15 @@
 Rhai Release Notes
 ==================
 
+Version 1.22.0
+==============
+
+Bug fixes
+---------
+
+* (Fuzzing) An integer-overflow bug from an inclusive range in `get_bits` is fixed.
+
+
 Version 1.21.0
 ==============
 

src/packages/bit_field.rs

@@ -2,7 +2,7 @@ use crate::eval::calc_index;
 use crate::plugin::*;
 use crate::{
     def_package, ExclusiveRange, InclusiveRange, Position, RhaiResultOf, ERR, INT, INT_BITS,
-    UNSIGNED_INT,
+    MAX_USIZE_INT, UNSIGNED_INT,
 };
 #[cfg(feature = "no_std")]
 use std::prelude::v1::*;
@@ -106,6 +106,12 @@ mod bit_field_functions {
     pub fn get_bits_range_inclusive(value: INT, range: InclusiveRange) -> RhaiResultOf<INT> {
         let from = INT::max(*range.start(), 0);
         let to = INT::max(*range.end(), from - 1);
+
+        #[allow(clippy::cast_sign_loss, clippy::cast_possible_truncation)]
+        if to > MAX_USIZE_INT || (to as usize) >= INT_BITS {
+            return Err(ERR::ErrorBitFieldBounds(INT_BITS, to, Position::NONE).into());
+        }
+
         get_bits(value, from, to - from + 1)
     }
     /// Return a portion of bits in the number as a new number.
@@ -126,6 +132,11 @@ mod bit_field_functions {
         if bits <= 0 {
             return Ok(0);
         }
+        let bits = if bits > MAX_USIZE_INT {
+            MAX_USIZE_INT
+        } else {
+            bits
+        };
 
         let bit = calc_index(INT_BITS, start, true, || {
             ERR::ErrorBitFieldBounds(INT_BITS, start, Position::NONE).into()

tests/get_set.rs

@@ -163,12 +163,12 @@ fn test_get_set_chain_without_write_back() {
 
     engine
         .register_type::<Inner>()
-        .register_get_set("value", |t: &mut Inner| t.value, |_: NativeCallContext, _: &mut Inner, new: INT| panic!("Inner::value setter called with {}", new))
+        .register_get_set("value", |t: &mut Inner| t.value, |_: NativeCallContext, _: &mut Inner, new: INT| -> () { panic!("Inner::value setter called with {}", new) })
         .register_type::<Outer>()
-        .register_get_set("inner", |_: NativeCallContext, t: &mut Outer| t.inner.clone(), |_: &mut Outer, new: Inner| panic!("Outer::inner setter called with {:?}", new));
+        .register_get_set("inner", |_: NativeCallContext, t: &mut Outer| t.inner.clone(), |_: &mut Outer, new: Inner| -> () { panic!("Outer::inner setter called with {:?}", new) });
 
     #[cfg(not(feature = "no_index"))]
-    engine.register_indexer_get_set(|t: &mut Outer, n: INT| Inner { value: t.inner.value * n }, |_: &mut Outer, n: INT, new: Inner| panic!("Outer::inner index setter called with {} and {:?}", n, new));
+    engine.register_indexer_get_set(|t: &mut Outer, n: INT| Inner { value: t.inner.value * n }, |_: &mut Outer, n: INT, new: Inner| -> () { panic!("Outer::inner index setter called with {} and {:?}", n, new) });
 
     assert_eq!(engine.eval_with_scope::<INT>(&mut scope, "outer.inner.value").unwrap(), 42);