Skip to content

Fix heap buffer overflow in uncompress*Array (truncated output allocation) #735

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iliasabk wants to merge 1 commit into
base: main
Choose a base branch
from
+22 −0
Open

Fix heap buffer overflow in uncompress*Array (truncated output allocation) #735

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions src/main/java/org/xerial/snappy/Snappy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -608,6 +608,7 @@ public static char[] uncompressCharArray(byte[] input, int offset, int length)
throws IOException
{
int uncompressedLength = Snappy.uncompressedLength(input, offset, length);
validateUncompressedLength(uncompressedLength, 2);
char[] result = new char[uncompressedLength / 2];
impl.rawUncompress(input, offset, length, result, 0);
return result;
Expand Down Expand Up @@ -639,6 +640,7 @@ public static double[] uncompressDoubleArray(byte[] input, int offset, int lengt
throws IOException
{
int uncompressedLength = Snappy.uncompressedLength(input, offset, length);
validateUncompressedLength(uncompressedLength, 8);
double[] result = new double[uncompressedLength / 8];
impl.rawUncompress(input, offset, length, result, 0);
return result;
Expand Down Expand Up @@ -741,6 +743,7 @@ public static float[] uncompressFloatArray(byte[] input, int offset, int length)
throws IOException
{
int uncompressedLength = Snappy.uncompressedLength(input, offset, length);
validateUncompressedLength(uncompressedLength, 4);
float[] result = new float[uncompressedLength / 4];
impl.rawUncompress(input, offset, length, result, 0);
return result;
Expand Down Expand Up @@ -772,6 +775,7 @@ public static int[] uncompressIntArray(byte[] input, int offset, int length)
throws IOException
{
int uncompressedLength = Snappy.uncompressedLength(input, offset, length);
validateUncompressedLength(uncompressedLength, 4);
int[] result = new int[uncompressedLength / 4];
impl.rawUncompress(input, offset, length, result, 0);
return result;
Expand Down Expand Up @@ -803,6 +807,7 @@ public static long[] uncompressLongArray(byte[] input, int offset, int length)
throws IOException
{
int uncompressedLength = Snappy.uncompressedLength(input, offset, length);
validateUncompressedLength(uncompressedLength, 8);
long[] result = new long[uncompressedLength / 8];
impl.rawUncompress(input, offset, length, result, 0);
return result;
Expand Down Expand Up @@ -834,11 +839,28 @@ public static short[] uncompressShortArray(byte[] input, int offset, int length)
throws IOException
{
int uncompressedLength = Snappy.uncompressedLength(input, offset, length);
validateUncompressedLength(uncompressedLength, 2);
short[] result = new short[uncompressedLength / 2];
impl.rawUncompress(input, offset, length, result, 0);
return result;
}

/**
* Reject an uncompressed byte length that is not a multiple of the target
* element size. The typed uncompress*Array methods size the result array
* by integer division; without this check a non-multiple length would
* under-allocate the array while native code writes the full byte count.
*/
private static void validateUncompressedLength(int uncompressedLength, int elementSize)
throws IOException
{
if (uncompressedLength % elementSize != 0) {
throw new IOException(
"uncompressed length " + uncompressedLength +
" is not a multiple of the element size " + elementSize);
}
}

/**
* Uncompress the input as a String
*
Expand Down
Loading