From 5ce32dda1086b3c2e1bd027b645de71f18211684 Mon Sep 17 00:00:00 2001
From: Minh Vu <fallintoplace@users.noreply.github.com>
Date: Tue, 23 Jun 2026 21:45:14 +0200
Subject: [PATCH] Check remote range end arithmetic

---
 cpp/src/remote_handle.cpp        |  8 ++++++--
 cpp/tests/test_remote_handle.cpp | 13 +++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/cpp/src/remote_handle.cpp b/cpp/src/remote_handle.cpp
index 271bf4eb89..63cd7af2cc 100644
--- a/cpp/src/remote_handle.cpp
+++ b/cpp/src/remote_handle.cpp
@@ -8,6 +8,7 @@
 #include <cstddef>
 #include <cstring>
 #include <iostream>
+#include <limits>
 #include <memory>
 #include <regex>
 #include <sstream>
@@ -173,8 +174,11 @@ std::size_t get_file_size_using_head_impl(RemoteEndpoint& endpoint, std::string
 void setup_range_request_impl(CurlHandle& curl, std::size_t file_offset, std::size_t size)
 {
   KVIKIO_EXPECT(size > 0, "cannot create a zero-size range request", std::invalid_argument);
-  std::string const byte_range =
-    std::to_string(file_offset) + "-" + std::to_string(file_offset + size - 1);
+  KVIKIO_EXPECT(size <= std::numeric_limits<std::size_t>::max() - file_offset,
+                "cannot create a range request with overflowing end offset",
+                std::invalid_argument);
+  auto const end_offset        = file_offset + size - 1;
+  std::string const byte_range = std::to_string(file_offset) + "-" + std::to_string(end_offset);
   curl.setopt(CURLOPT_RANGE, byte_range.c_str());
 }
 
diff --git a/cpp/tests/test_remote_handle.cpp b/cpp/tests/test_remote_handle.cpp
index 1ecacad025..54f2dc563c 100644
--- a/cpp/tests/test_remote_handle.cpp
+++ b/cpp/tests/test_remote_handle.cpp
@@ -4,6 +4,7 @@
  */
 
 #include <functional>
+#include <limits>
 #include <memory>
 #include <optional>
 #include <stdexcept>
@@ -15,6 +16,7 @@
 #include <gtest/gtest.h>
 #include <kvikio/hdfs.hpp>
 #include <kvikio/remote_handle.hpp>
+#include <kvikio/shim/libcurl.hpp>
 
 #include "utils/env.hpp"
 
@@ -173,6 +175,17 @@ TEST_F(RemoteHandleTest, read_zero_size_returns_without_range_request)
   EXPECT_EQ(endpoint_ptr->range_request_calls, 0);
 }
 
+TEST_F(RemoteHandleTest, range_request_rejects_overflowing_end_offset)
+{
+  kvikio::HttpEndpoint endpoint{"http://example.com/test"};
+  auto curl = create_curl_handle();
+
+  auto constexpr file_offset = std::numeric_limits<std::size_t>::max() - 1;
+  auto constexpr size        = std::size_t{4};
+  EXPECT_THAT([&] { endpoint.setup_range_request(curl, file_offset, size); },
+              ThrowsMessage<std::invalid_argument>(HasSubstr("overflowing end offset")));
+}
+
 TEST_F(RemoteHandleTest, test_s3_url)
 {
   kvikio::test::EnvVarContext env_var_ctx{{"AWS_DEFAULT_REGION", "my_aws_default_region"},