| शीर्षक | xerial snappy-java 1.1.10.8 Off heap OOB Write in ByteBuffer Uncompress |
|---|
| विवरण | I was auditing the ByteBuffer decompression path in snappy-java and noticed that Snappy.uncompress(ByteBuffer, ByteBuffer) never checks whether the destination buffer is large enough before writing into it. The decompressed size comes straight from the compressed input's own length prefix — fully attacker-controlled — and the native layer just writes that many bytes into the destination regardless of its actual capacity. A valid, well-formed Snappy blob that decompresses to more bytes than the destination buffer holds writes past the end of the off-heap allocation and crashes the JVM with a SIGSEGV.
Interestingly, the sibling API BitShuffle.shuffle(ByteBuffer, ByteBuffer) already does the equivalent capacity check before calling native code — this path just doesn't have one. The method's Javadoc suggests calling isValidCompressedBuffer first, but that only checks stream well-formedness, not whether the output fits the destination. |
|---|
| स्रोत | ⚠️ https://github.com/xerial/snappy-java/issues/728 |
|---|
| उपयोगकर्ता | Yu Bao from PayPal Cyber Security Team (UID 99838) |
|---|
| सबमिशन | 14/08/2026 10:21 AM (2 महीनों पहले) |
|---|
| संयम | 14/09/2026 09:17 AM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 403173 [Xerial snappy-java तक 1.1.10.8 Snappy.uncompress बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|