Github-Mirror/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-09-20 13:30:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(s3api): reject lifecycle rules whose TTL overflows int32 seconds

Browse Source 
bucketLifecycleTTLRule.TtlSec is int32. AWS allows Expiration.Days up
to 2,147,483,647 which would silently overflow when multiplied by
LifeCycleInterval. Compute in int64, return InvalidRequest above
math.MaxInt32 seconds.
This commit is contained in:
Chris Lu
2026-05-07 22:28:20 -07:00
parent aaaf2fb53f
commit 7f1bded535
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
weed/s3api/s3api_bucket_handlers.go
+10 -1
View File
@@ -880,7 +880,16 @@ func (s3a *S3ApiServer) PutBucketLifecycleConfigurationHandler(w http.ResponseWr
if rule.Expiration.Days == 0 {
continue
}
ttlSec := int32((time.Duration(rule.Expiration.Days) * util.LifeCycleInterval).Seconds())
// Compute in int64 first, then refuse rules whose TTL won't fit
// int32 seconds. AWS allows Days up to 2,147,483,647, which would
// silently overflow if we cast directly.
ttlSecondsInt64 := int64(rule.Expiration.Days) * int64(util.LifeCycleInterval/time.Second)
if ttlSecondsInt64 > math.MaxInt32 {
glog.Errorf("PutBucketLifecycleConfigurationHandler %s: Expiration.Days=%d exceeds int32-second TTL", bucket, rule.Expiration.Days)
s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
return
}
ttlSec := int32(ttlSecondsInt64)
lifecycleRules = append(lifecycleRules, bucketLifecycleTTLRule{
Prefix: rulePrefix,
TtlSec: ttlSec,