From: Thomas Markwalder <tmark@isc.org>
Date: Mon, 3 Aug 2026 16:48:14 +0000 (-0400)
Subject: [#4666] Added InputBuffer::getRemaining() function
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ffc14976425d43d39b21d2d1ffbc5cd096e8d8cf;p=thirdparty%2Fkea.git

[#4666] Added InputBuffer::getRemaining() function

modified:   changelog_unreleased/4666-inputbuffer-bounds-checks-use-pointer-arithmetic-vulnerable-to-overflow
modified:   src/lib/util/buffer.h
---

diff --git a/changelog_unreleased/4666-inputbuffer-bounds-checks-use-pointer-arithmetic-vulnerable-to-overflow b/changelog_unreleased/4666-inputbuffer-bounds-checks-use-pointer-arithmetic-vulnerable-to-overflow
index 21bd144f7d..bf6fe6c39b 100644
--- a/changelog_unreleased/4666-inputbuffer-bounds-checks-use-pointer-arithmetic-vulnerable-to-overflow
+++ b/changelog_unreleased/4666-inputbuffer-bounds-checks-use-pointer-arithmetic-vulnerable-to-overflow
@@ -1,4 +1,4 @@
-[bug]		wlodek
+[bug]		wlodek,tmark
 	Fixed InputBuffer bounds checks to use size comparisons
 	instead of pointer arithmetic that could overflow for
 	very large offsets or lengths.
diff --git a/src/lib/util/buffer.h b/src/lib/util/buffer.h
index 9be1b2a9a3..1db2321c49 100644
--- a/src/lib/util/buffer.h
+++ b/src/lib/util/buffer.h
@@ -102,6 +102,11 @@ public:
         return (static_cast<size_t>(current_ - base_));
     }
 
+    /// @brief Return the size remaining to be read.
+    size_t getRemaining() const {
+        return (static_cast<size_t>(end_ - current_));
+    }
+
     /// @brief Set the read position of the buffer to the given value.
     ///
     /// @details The new position must be in the valid range of the buffer;
@@ -125,7 +130,7 @@ public:
     /// @details If the remaining length of the buffer is smaller than 8-bit,
     /// an exception of class @c isc::OutOfRange will be thrown.
     uint8_t peekUint8() {
-        if (sizeof(uint8_t) > getLength() - getPosition()) {
+        if (sizeof(uint8_t) > getRemaining()) {
             isc_throw(OutOfRange,
                       "InputBuffer::peekUint8 read beyond end of buffer");
         }
@@ -149,7 +154,7 @@ public:
     /// @details If the remaining length of the buffer is smaller than 16-bit,
     /// an exception of class @c isc::OutOfRange will be thrown.
     uint16_t peekUint16() {
-        if (sizeof(uint16_t) > getLength() - getPosition()) {
+        if (sizeof(uint16_t) > getRemaining()) {
             isc_throw(OutOfRange,
                       "InputBuffer::peekUint16 read beyond end of buffer");
         }
@@ -177,7 +182,7 @@ public:
     /// @details If the remaining length of the buffer is smaller than 32-bit,
     /// an exception of class @c isc::OutOfRange will be thrown.
     uint32_t peekUint32() {
-        if (sizeof(uint32_t) > getLength() - getPosition()) {
+        if (sizeof(uint32_t) > getRemaining()) {
             isc_throw(OutOfRange,
                       "InputBuffer::peekUint32 read beyond end of buffer");
         }
@@ -212,7 +217,7 @@ public:
     void peekData(void* data, size_t len) {
         // Compare remaining size to len; pointer addition can wrap for
         // very large len values and bypass the check.
-        if (len > getLength() - getPosition()) {
+        if (len > getRemaining()) {
             isc_throw(OutOfRange,
                       "InputBuffer::peekData read beyond end of buffer");
         }
@@ -243,7 +248,7 @@ public:
     /// @param data Reference to a buffer (data will be stored there).
     /// @param len Size specified number of bytes to read in a vector.
     void peekVector(std::vector<uint8_t>& data, size_t len) {
-        if (len > getLength() - getPosition()) {
+        if (len > getRemaining()) {
             isc_throw(OutOfRange,
                       "InputBuffer::peekVector read beyond end of buffer");
         }