| タイトル | xerial snappy-java 1.1.10.8 Off heap OOB Write in ByteBuffer Uncompress |
|---|
| 説明 | I was auditing the ByteBuffer decompression path in snappy-java and noticed that Snappy.uncompress(ByteBuffer, ByteBuffer) never checks whether the destination buffer is large enough before writing into it. The decompressed size comes straight from the compressed input's own length prefix — fully attacker-controlled — and the native layer just writes that many bytes into the destination regardless of its actual capacity. A valid, well-formed Snappy blob that decompresses to more bytes than the destination buffer holds writes past the end of the off-heap allocation and crashes the JVM with a SIGSEGV.
Interestingly, the sibling API BitShuffle.shuffle(ByteBuffer, ByteBuffer) already does the equivalent capacity check before calling native code — this path just doesn't have one. The method's Javadoc suggests calling isValidCompressedBuffer first, but that only checks stream well-formedness, not whether the output fits the destination. |
|---|
| ソース | ⚠️ https://github.com/xerial/snappy-java/issues/728 |
|---|
| ユーザー | Yu Bao from PayPal Cyber Security Team (UID 99838) |
|---|
| 送信 | 2026年08月14日 10:21 (2 月 ago) |
|---|
| モデレーション | 2026年09月14日 09:17 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 403173 [Xerial snappy-java 迄 1.1.10.8 Snappy.uncompress メモリ破損] |
|---|
| ポイント | 0 |
|---|