Fix: strengthen Input validation and prevent Integer overflows

pkg/ingester/pyroscope/ingest_handler.go

@@ -124,7 +124,7 @@ func (h ingestHandler) parseInputMetadataFromRequest(_ context.Context, r *http.
 	}
 
 	if sr := q.Get("sampleRate"); sr != "" {
-		sampleRate, err := strconv.Atoi(sr)
+		sampleRate, err := strconv.ParseUint(sr, 10, 32)
 		if err != nil {
 			_ = h.log.Log(
 				"err", err,

pkg/metastore/fsm/log_entry.go

@@ -58,6 +58,10 @@ func marshal(v proto.Message) ([]byte, error) {
 	if err != nil {
 		return raw, err
 	}
+	maxRawSize := 64 * 1024 * 1024 // 64 MB guard
+	if len(raw) > maxRawSize {
+		return nil, fmt.Errorf("marshaled message too large: %d bytes", len(raw))
+	}
 	buf := make([]byte, 4+len(raw))
 	copy(buf[4:], raw)
 	return buf, err

pkg/og/util/bytesize/bytesize.go

@@ -3,6 +3,7 @@ package bytesize
 import (
 	"errors"
 	"fmt"
+	"math"
 	"regexp"
 	"strconv"
 	"strings"
@@ -88,6 +89,9 @@ func Parse(str string) (ByteSize, error) {
 	if err != nil {
 		return 0, errParse
 	}
+	if val > uint64(math.MaxInt64) {
+		return 0, errParse
+	}
 	return ByteSize(val) * multiplier, nil
 }
 

pkg/querier/replication.go

@@ -4,7 +4,8 @@
 	"context"
 	"encoding/json"
 	"fmt"
 	"sort"
+	"math"
 
 	"github.com/cespare/xxhash/v2"
 	"github.com/go-kit/log"
@@ -249,6 +250,15 @@
 				// not a sharded block continue
 				continue
 			}
+
+			// Bounds check before converting shards and using as slice length or index
+			if shards == 0 || shards > uint64(math.MaxInt) {
+				return false, fmt.Errorf("invalid shard count (must be 1..%d), got: %d, for block id %s", math.MaxInt, shards, block)
+			}
+			if shardIdx >= shards {
+				return false, fmt.Errorf("invalid shardIdx: %d for shard count %d", shardIdx, shards)
+			}
+
 			hasShardedBlocks = true
 			shardedBlocks = append(shardedBlocks, block)
 

pkg/storegateway/gateway_blocks_http.go

@@ -5,11 +5,12 @@
 import (
 	_ "embed" // Used to embed html template
 	"fmt"
 	"html/template"
 	"net/http"
 	"path/filepath"
 	"strconv"
 	"time"
+	"math"
 
 	"github.com/dustin/go-humanize"
 	"github.com/gorilla/mux"
@@ -74,9 +75,11 @@
 	showParents := req.Form.Get("show_parents") == "on"
 	var splitCount int
 	if sc := req.Form.Get("split_count"); sc != "" {
-		splitCount, _ = strconv.Atoi(sc)
-		if splitCount < 0 {
+		parsed, _ := strconv.ParseInt(sc, 10, 32)
+		if parsed < 0 || parsed > int64(math.MaxUint32) {
 			splitCount = 0
+		} else {
+			splitCount = int(parsed)
 		}
 	}