[YQL-15070,YQL-15069] Check values in TValuePacker::UnpackImpl

ref:0d215582eaa351e0f92fa25c3e2dc923e8e35f6e

1 files changed, 3 insertions, 0 deletions

diff --git a/ydb/library/yql/minikql/computation/mkql_computation_node_pack.cpp b/ydb/library/yql/minikql/computation/mkql_computation_node_pack.cpp
index 20a7f5d9578..71e5fa7e8e9 100644
--- a/ydb/library/yql/minikql/computation/mkql_computation_node_pack.cpp
+++ b/ydb/library/yql/minikql/computation/mkql_computation_node_pack.cpp
@@ -451,6 +451,7 @@ NUdf::TUnboxedValue TValuePacker::UnpackImpl(const TType* type, TStringBuf& buf,
         auto itemType = listType->GetItemType();
         const auto len = NDetails::UnpackUInt64(buf);
         NUdf::TUnboxedValue *items = nullptr;
+        MKQL_ENSURE(len <= Max<ui32>(), "Bad list length: " << len);
         auto list = holderFactory.CreateDirectArrayHolder(len, items);
         for (ui64 i = 0; i < len; ++i) {
             *items++ = UnpackImpl(itemType, buf, topLength, holderFactory);
@@ -500,9 +501,11 @@ NUdf::TUnboxedValue TValuePacker::UnpackImpl(const TType* type, TStringBuf& buf,
         ui32 variantIndex = NDetails::UnpackUInt32(buf);
         TType* innerType = variantType->GetUnderlyingType();
         if (innerType->IsStruct()) {
+            MKQL_ENSURE(variantIndex < static_cast<TStructType*>(innerType)->GetMembersCount(), "Bad variant index: " << variantIndex);
             innerType = static_cast<TStructType*>(innerType)->GetMemberType(variantIndex);
         } else {
             MKQL_ENSURE(innerType->IsTuple(), "Unexpected underlying variant type: " << innerType->GetKindAsStr());
+            MKQL_ENSURE(variantIndex < static_cast<TTupleType*>(innerType)->GetElementsCount(), "Bad variant index: " << variantIndex);
             innerType = static_cast<TTupleType*>(innerType)->GetElementType(variantIndex);
         }
         return holderFactory.CreateVariantHolder(UnpackImpl(innerType, buf, topLength, holderFactory).Release(), variantIndex);