提出 #872771: TrailDB 0.6 Out-of-Bounds Read

TrailDB 0.6 contains an out-of-bounds read vulnerability in tdb_get_trail() caused by insufficient validation of trails.toc offsets. When TrailDB opens a malformed TrailDB directory or packaged .tdb file, tdb_open() maps trails.toc and trails.data into memory but does not verify whether the TOC contains enough entries, whether the offsets are within the trails.data mapping, or whether the offsets are monotonic.

An attacker who can provide a crafted TrailDB file can set the TOC offsets to values outside the valid trails.data range. When the database is later traversed, tdb_get_trail() uses the attacker-controlled offset to construct a pointer into trails.data and passes it to read_bits(), which dereferences the invalid location. This can cause official TrailDB tools such as tdb dump and traildb_bench dump, as well as applications using libtraildb, to crash when processing the malformed database.

The demonstrated impact is denial of service through an out-of-bounds read. Code execution and reliable information disclosure have not been demonstrated. The issue is most relevant to applications, services, or batch processing workflows that open and query TrailDB files from untrusted or semi-trusted sources.

Note: This submission is a resubmission of Submit #847476, which was previously rejected only because a public upstream issue link was missing. A public issue report has now been created in the project's GitHub repository as requested.

• ソース: ⚠️ https://github.com/traildb/traildb/issues/149
• ユーザー: Fantasy_2026 (UID 98691)
• 送信: 2026年06月29日 03:11 (2 月 ago)
• モデレーション: 2026年08月16日 07:55 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 391111 [TrailDB 0.6 TOC Validation /src/tdb.c tdb_open 情報漏えい]
• ポイント: 20