| 제목 | TrailDB 0.6 Out-of-Bounds Read |
|---|
| 설명 | TrailDB 0.6 contains an out-of-bounds read vulnerability in tdb_get_trail() caused by insufficient validation of trails.toc offsets. When TrailDB opens a malformed TrailDB directory or packaged .tdb file, tdb_open() maps trails.toc and trails.data into memory but does not verify whether the TOC contains enough entries, whether the offsets are within the trails.data mapping, or whether the offsets are monotonic.
An attacker who can provide a crafted TrailDB file can set the TOC offsets to values outside the valid trails.data range. When the database is later traversed, tdb_get_trail() uses the attacker-controlled offset to construct a pointer into trails.data and passes it to read_bits(), which dereferences the invalid location. This can cause official TrailDB tools such as tdb dump and traildb_bench dump, as well as applications using libtraildb, to crash when processing the malformed database.
The demonstrated impact is denial of service through an out-of-bounds read. Code execution and reliable information disclosure have not been demonstrated. The issue is most relevant to applications, services, or batch processing workflows that open and query TrailDB files from untrusted or semi-trusted sources.
Note: This submission is a resubmission of Submit #847476, which was previously rejected only because a public upstream issue link was missing. A public issue report has now been created in the project's GitHub repository as requested. |
|---|
| 원천 | ⚠️ https://github.com/traildb/traildb/issues/149 |
|---|
| 사용자 | Fantasy_2026 (UID 98691) |
|---|
| 제출 | 2026. 06. 29. AM 03:11 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 16. AM 07:55 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 391111 [TrailDB 0.6 TOC Validation /src/tdb.c tdb_open 정보 공개] |
|---|
| 포인트들 | 20 |
|---|