Jens Geyer created THRIFT-6091:
----------------------------------
Summary: Widen container-size precheck to 64-bit in C++, C/GLib,
Go, netstd, Delphi, and Haxe protocols
Key: THRIFT-6091
URL: https://issues.apache.org/jira/browse/THRIFT-6091
Project: Thrift
Issue Type: Bug
Components: C++ - Library, C glib - Library, Haxe - Library, Delphi -
Library, Go - Library, netstd - Library
Reporter: Jens Geyer
Fix For: 0.24.0
The container-size precheck that multiplies an on-wire element count by the
minimum element size, used to reject oversized list/set/map allocations before
they are attempted, performed that multiply in 32-bit arithmetic. A crafted
count near the top of the valid range could overflow the multiply and wrap to a
small value, letting an oversized allocation slip past the check.
Fixed by widening the precheck multiply to 64-bit across the affected
implementations:
* C++ / C-GLib: PR #3590 (commit 983c813c9)
* Go: commits ed643a86d and 137d693e2 (binary/compact and JSON paths)
* netstd, Delphi, Haxe: commit 80ed45a71
*Affects:* C++, C/GLib, and Go confirmed present in 0.23.0; fixed in 0.24.0
*Fixed by:* see commits above; the C++/C-GLib fix (PR #3590) was already public
in master prior to this report
*CWE-190:* Integer Overflow or Wraparound
*CVSS 4.0:* 8.7 High
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
*Reported by:* Ghaith Abdulreda, via [email protected]; fix contributed by
Javid Khan (PR #3590, PR #3604) and Jens Geyer (netstd/Delphi/Haxe, Go JSON
path)
*CVE:* CVE-2026-55969
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
