| Título | xerial snappy-java 1.1.10.8 Off heap OOB Write in ByteBuffer Uncompress |
|---|
| Descripción | I was auditing the ByteBuffer decompression path in snappy-java and noticed that Snappy.uncompress(ByteBuffer, ByteBuffer) never checks whether the destination buffer is large enough before writing into it. The decompressed size comes straight from the compressed input's own length prefix — fully attacker-controlled — and the native layer just writes that many bytes into the destination regardless of its actual capacity. A valid, well-formed Snappy blob that decompresses to more bytes than the destination buffer holds writes past the end of the off-heap allocation and crashes the JVM with a SIGSEGV.
Interestingly, the sibling API BitShuffle.shuffle(ByteBuffer, ByteBuffer) already does the equivalent capacity check before calling native code — this path just doesn't have one. The method's Javadoc suggests calling isValidCompressedBuffer first, but that only checks stream well-formedness, not whether the output fits the destination. |
|---|
| Fuente | ⚠️ https://github.com/xerial/snappy-java/issues/728 |
|---|
| Usuario | Yu Bao from PayPal Cyber Security Team (UID 99838) |
|---|
| Sumisión | 2026-08-14 10:21 (hace 2 meses) |
|---|
| Moderación | 2026-09-14 09:17 (1 month later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 403173 [Xerial snappy-java hasta 1.1.10.8 Snappy.uncompress desbordamiento de búfer] |
|---|
| Puntos | 0 |
|---|