{"id":"GO-2021-0225","details":"Certain invalid inputs to ReadUvarint or ReadVarint could cause those\nfunctions to read an unlimited number of bytes from the ByteReader argument\nbefore returning an error. This could lead to processing more input than\nexpected when the caller is reading directly from a network and depends on\nReadUvarint and ReadVarint only consuming a small, bounded number of bytes,\neven from invalid inputs.\n\nWith the update, ReadUvarint and ReadVarint now always return after consuming\na bounded number of bytes (specifically, MaxVarintLen64, which is 10). The\nresult being returned has not changed; the functions merely detect and return\nsome errors without reading as much input.\n","modified":"2022-05-13T18:33:00Z","published":"2022-01-13T03:44:52Z","withdrawn":"2024-05-15T05:37:11.088754Z","references":[{"type":"FIX","url":"https://go.dev/cl/247120"},{"type":"FIX","url":"https://go.googlesource.com/go/+/027d7241ce050d197e7fabea3d541ffbe3487258"},{"type":"WEB","url":"https://go.dev/issue/40618"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/NyPIaucMgXo"}],"affected":[{"package":{"name":"encoding/binary","ecosystem":"Go","purl":"pkg:golang/encoding/binary"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.15"},{"introduced":"1.14.0"},{"fixed":"1.14.7"}]}],"ecosystem_specific":{"symbols":["ReadUvarint"]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2021-0225.json","url":"https://pkg.go.dev/vuln/GO-2021-0225"}}],"schema_version":"1.7.3"}