Reject negative array and map header sizes (#742)

Author: jakezwang

msgpack/_packer.pyx

@@ -300,6 +300,8 @@ cdef class Packer:
     @cython.critical_section
     def pack_array_header(self, long long size):
         self._check_exports()
+        if size < 0:
+            raise ValueError("array size must be non-negative")
         if size > ITEM_LIMIT:
             raise ValueError("array too large")
         msgpack_pack_array(&self.pk, size)
@@ -311,6 +313,8 @@ cdef class Packer:
     @cython.critical_section
     def pack_map_header(self, long long size):
         self._check_exports()
+        if size < 0:
+            raise ValueError("map size must be non-negative")
         if size > ITEM_LIMIT:
             raise ValueError("map too learge")
         msgpack_pack_map(&self.pk, size)

msgpack/fallback.py

@@ -837,6 +837,8 @@ def pack_map_pairs(self, pairs):
             return ret
 
     def pack_array_header(self, n):
+        if n < 0:
+            raise ValueError("array size must be non-negative")
         if n >= 2**32:
             raise ValueError
         self._pack_array_header(n)
@@ -846,6 +848,8 @@ def pack_array_header(self, n):
             return ret
 
     def pack_map_header(self, n):
+        if n < 0:
+            raise ValueError("map size must be non-negative")
         if n >= 2**32:
             raise ValueError
         self._pack_map_header(n)

test/test_limits.py

@@ -52,6 +52,16 @@ def test_map_header():
         packer.pack_array_header(2**32)
 
 
+@pytest.mark.parametrize("method", ["pack_array_header", "pack_map_header"])
+@pytest.mark.parametrize("size", [-1, -(2**32)])
+def test_negative_header_size(method, size):
+    packer = Packer(autoreset=False)
+    packer.pack("existing")
+    with pytest.raises(PackValueError, match="size must be non-negative"):
+        getattr(packer, method)(size)
+    assert packer.bytes() == packb("existing")
+
+
 def test_max_str_len():
     d = "x" * 3
     packed = packb(d)