Skip to content

Conversation

sraybell
Copy link
Contributor

This fixes an overflow when creating the hash for type Int64 (long). The
result is calculated before the cast, to ensure that the resulting
integer isn't negative before the modulo is applied, which can occur
when the value is sufficiently large..

By downcasting the Int64 before the modulo operation, significant
information is lost, the value will likely not result in the expected
index, resulting in an erroneous letter being pulled from the alphabet,
or an IndexOutOfRangeException being thrown due to negative values.

This fixes an overflow when creating the hash for type Int64 (long). The
result is calculated before the cast, to ensure that the resulting
integer isn't negative before the modulo is applied, which can occur
when the value is sufficiently large..

By downcasting the Int64 before the modulo operation, significant
information is lost, the value will likely not result in the expected
index, resulting in an erroneous letter being pulled from the alphabet,
or an IndexOutOfRangeException being thrown due to negative values.
@ullmark
Copy link
Owner

ullmark commented Jul 30, 2015

Nice catch, do you have a case where the bug is showing so we can construct a test for the bug?

@ullmark
Copy link
Owner

ullmark commented Aug 16, 2015

I've been running for-loops encoding+decoding+verify of longs. I've started at Int64.MaxValue / 2 and going up incrementing some random number. I have yet been able to get any issues with the code base. If you have any example of where you've seen it would be really cool if you could send that over.

@sraybell
Copy link
Contributor Author

Yeah, I'm terrible sorry about this. I have been super busy and I've been meaning to circle back with you on this. It's not just the casting that's the issue. This also happens with large quantities of longs. I believe I had something on the order of 50,000 large values, but I don't recall. I am in the process of coming up with a very concise, sanitized example that should help in creating a test.

@sraybell
Copy link
Contributor Author

Here's a gist that, while seemingly contrived, does hit close to the size of the data. Now, we could argue that maybe this isn't a good use of Hashids with a dataset this size, but that's neither here nor there right now. ;-)

git@gist.github.com:62de4246b3953f5e8c3d.git

@ullmark
Copy link
Owner

ullmark commented Aug 25, 2015

cool, I'll have a look

@ullmark ullmark merged commit 9a45e71 into ullmark:master Aug 29, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants