index: guard posting iterator against overflowing varints

index/hititer.go

@@ -187,6 +187,15 @@ type compressedPostingIterator struct {
 
 func newCompressedPostingIterator(b []byte, w ngram) *compressedPostingIterator {
 	d, sz := binary.Uvarint(b)
+	if sz <= 0 {
+		// binary.Uvarint returns a non-positive length when b is empty or the
+		// varint overflows 64 bits; slicing b[sz:] would panic, so yield an
+		// exhausted iterator (issue #1106).
+		return &compressedPostingIterator{
+			_first: math.MaxUint32,
+			what:   w,
+		}
+	}
 	return &compressedPostingIterator{
 		_first:           uint32(d),
 		blob:             b[sz:],
@@ -212,6 +221,12 @@ func (i *compressedPostingIterator) next(limit uint32) {
 
 	for i._first <= limit && len(i.blob) > 0 {
 		delta, sz := binary.Uvarint(i.blob)
+		if sz <= 0 {
+			// Corrupt or overflowing varint; stop advancing rather than panic
+			// on i.blob[sz:] (issue #1106).
+			i.blob = nil
+			break
+		}
 		i._first += uint32(delta)
 		i.indexBytesLoaded += sz
 		i.blob = i.blob[sz:]

index/hititer_test.go

@@ -16,6 +16,7 @@ package index
 
 import (
 	"fmt"
+	"math"
 	"math/rand"
 	"reflect"
 	"testing"
@@ -112,3 +113,24 @@ func genUints32(size int) []uint32 {
 	}
 	return nums
 }
+
+func TestCompressedPostingIterator_overflowVarint(t *testing.T) {
+	// A varint that overflows 64 bits makes binary.Uvarint return a negative
+	// length, so slicing blob[sz:] used to panic (issue #1106). The iterator
+	// must instead treat the posting list as exhausted.
+	overflow := []byte{0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x01}
+
+	// Construction from an overflowing first varint.
+	it := newCompressedPostingIterator(overflow, stringToNGram("abc"))
+	if got := it.first(); got != math.MaxUint32 {
+		t.Fatalf("first() after overflow varint = %d, want exhausted (%d)", got, uint32(math.MaxUint32))
+	}
+
+	// A valid first entry followed by an overflowing delta, hit while advancing.
+	blob := append([]byte{0x01}, overflow...)
+	it = newCompressedPostingIterator(blob, stringToNGram("abc"))
+	it.next(100)
+	if got := it.first(); got != math.MaxUint32 {
+		t.Fatalf("first() after overflow delta = %d, want exhausted (%d)", got, uint32(math.MaxUint32))
+	}
+}