| शीर्षक | Blosc c-blosc2 >= 2.0.0, < fix commit fe2964d114d9 Memory Corruption |
|---|
| विवरण | Heap out-of-bounds write in blosclz_decompress() (blosc/blosclz.c:734) of Blosc c-blosc2, 2.0.0 (2020) through 3.3.2, 32-bit builds only. The bounds check "op + len > op_limit" is pointer arithmetic that wraps modulo 2^32: a crafted chunk extends match length len to ~255 MB via an unbounded extension loop, op + len wraps past 4 GiB, the guard passes, and copy_match() writes ~255 MB into a 64 KB block. One blosc2_decompress() call on a malicious chunk gives an attacker-controlled-length heap overwrite — SIGSEGV/DoS at minimum, potential code execution. 64-bit unaffected. Fixed in fe2964d114d97847f56570a0ab2be2c57ccbeedc (2026-08-31); the issue and fix have been acknowledged and credited by the maintainer in the commit message. |
|---|
| स्रोत | ⚠️ https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc |
|---|
| उपयोगकर्ता | zzxzzb (UID 95450) |
|---|
| सबमिशन | 01/09/2026 08:26 AM (29 दिन पहले) |
|---|
| संयम | 30/09/2026 09:25 AM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 411905 [Blosc C-Blosc2 तक 3.3.2 blosclz Decompression blosc/blosclz.c blosclz_decompress बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|