Jens Geyer created THRIFT-6092:
----------------------------------
Summary: Fix off-by-ten header bounds check in readHeaderFormat
Key: THRIFT-6092
URL: https://issues.apache.org/jira/browse/THRIFT-6092
Project: Thrift
Issue Type: Bug
Components: C++ - Library
Reporter: Jens Geyer
Fix For: 0.24.0
THeaderTransport::readHeaderFormat() bounded the declared header size against
the wrong reference point (if (headerSize > sz)), allowing a read of up to 10
bytes past the end of the buffer.
Fixed by tightening the check to if (headerSize > sz - 10).
*Affects:* C++, confirmed present in 0.23.0 (buggy check at line 209); fixed in
0.24.0
*Fixed by:* PR #3597 (commits 4da36faee, ae251547b)
*CWE-126:* Buffer Over-read
*CVSS 4.0:* 6.9 Medium
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N}})
*Reported by:* Ghaith Abdulreda, via [email protected]; fix contributed by
Javid Khan, with test infrastructure by Jens Geyer
*CVE:* CVE-2026-55970
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
