| 제목 | xerial snappy-java 1.1.10.8 Off heap OOB Write in ByteBuffer Uncompress |
|---|
| 설명 | I was auditing the ByteBuffer decompression path in snappy-java and noticed that Snappy.uncompress(ByteBuffer, ByteBuffer) never checks whether the destination buffer is large enough before writing into it. The decompressed size comes straight from the compressed input's own length prefix — fully attacker-controlled — and the native layer just writes that many bytes into the destination regardless of its actual capacity. A valid, well-formed Snappy blob that decompresses to more bytes than the destination buffer holds writes past the end of the off-heap allocation and crashes the JVM with a SIGSEGV.
Interestingly, the sibling API BitShuffle.shuffle(ByteBuffer, ByteBuffer) already does the equivalent capacity check before calling native code — this path just doesn't have one. The method's Javadoc suggests calling isValidCompressedBuffer first, but that only checks stream well-formedness, not whether the output fits the destination. |
|---|
| 원천 | ⚠️ https://github.com/xerial/snappy-java/issues/728 |
|---|
| 사용자 | Yu Bao from PayPal Cyber Security Team (UID 99838) |
|---|
| 제출 | 2026. 08. 14. AM 10:21 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 14. AM 09:17 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 403173 [Xerial snappy-java 까지 1.1.10.8 Snappy.uncompress 메모리 손상] |
|---|
| 포인트들 | 0 |
|---|