Jens Geyer created THRIFT-6094:
----------------------------------
Summary: Copy buffered data not the GByteArray struct in c_glib
read_slow
Key: THRIFT-6094
URL: https://issues.apache.org/jira/browse/THRIFT-6094
Project: Thrift
Issue Type: Bug
Components: C glib - Library
Reporter: Jens Geyer
Fix For: 0.24.0
thrift_buffered_transport_read_slow() and thrift_framed_transport_read_slow()
each handle a leftover-bytes path with memcpy(buf, t->r_buf, have). t->r_buf is
a GByteArray*, so this copied the struct's own fields (a heap pointer and a
length integer) into the caller's decode buffer rather than the intended
payload bytes; when more than sizeof(GByteArray) bytes were leftover, the copy
additionally read past the end of the struct into adjacent heap memory, which
could then surface in decoded message fields.
Fixed by copying from t->r_buf->data (the pattern already used everywhere else
in both files) instead of t->r_buf.
*Affects:* c_glib (ThriftBufferedTransport, ThriftFramedTransport); fixed in
0.24.0
*Fixed by:* PR #3607 (commit f20a320c2), merged 2026-06-27
*CWE-125:* Out-of-bounds Read
*CVSS 4.0:* 6.9 Medium
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N}})
*Reported by:* found and fixed by Javid Khan (PR #3607)
*CVE:* CVE-2026-58023
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
