From e56e90f40b76327d694950814f1a4b2ed2c0c24c Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Thu, 13 Nov 2025 00:11:18 +0000 Subject: [PATCH] Potential fix for code scanning alert no. 10: Size computation for allocation may overflow Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- internal/cache/backends/redis_pool.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/internal/cache/backends/redis_pool.go b/internal/cache/backends/redis_pool.go index 6016fb1..e2ae93f 100644 --- a/internal/cache/backends/redis_pool.go +++ b/internal/cache/backends/redis_pool.go @@ -255,6 +255,18 @@ func (c *RedisConn) Do(command string, args ...string) (interface{}, error) { if argsLen < 0 || argsLen > maxSafeArgs { return nil, errors.New("too many arguments") } + const maxTotalArgBytes = 64 << 20 // 64 MiB max total size + totalBytes := len(command) + for _, s := range args { + // Protect against possible overflow + if len(s) > maxTotalArgBytes-totalBytes { + return nil, errors.New("arguments too large (would overflow maximum allowed total size)") + } + totalBytes += len(s) + if totalBytes > maxTotalArgBytes { + return nil, errors.New("total argument size exceeds maximum allowed") + } + } cmdArgs := make([]string, 0, argsLen+1) cmdArgs = append(cmdArgs, command) cmdArgs = append(cmdArgs, args...)