search

FasterXML / jackson-dataformats-binary

Uber-project for standard Jackson binary format backends: avro, cbor, ion, protobuf, smile
Apache License 2.0
310 stars 133 forks source link

(smile) Handle invalid chunked-binary-format length gracefully #263

Closed cowtowncoder closed 3 years ago

cowtowncoder commented 3 years ago

(found by OssFuzzer https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32339)

Another nice finding by ozz-fuzz project: looks like length handling for chunked (7-bit safe) binary blocks is missing some checks to either prevent use of negative lengths, or avoid int overflow.

cowtowncoder commented 3 years ago

Specifically, it's "all of above": method _readUnsignedVInt() needs to validate that the input value does not overflow positive 32-bit int.