Jens Geyer created THRIFT-6096:
----------------------------------
Summary: Fix info-header string bound check in
THeaderTransport::readString
Key: THRIFT-6096
URL: https://issues.apache.org/jira/browse/THRIFT-6096
Project: Thrift
Issue Type: Bug
Components: C++ - Library
Reporter: Jens Geyer
Fix For: 0.24.0
THeaderTransport::readString() (used while parsing THeader info-header
key/value strings) read a length-prefixed string with two independent defects
in the pre-fix code: (1) the declared length was a signed 32-bit value with no
rejection of negative values, so a crafted 5-byte varint decoding to INT32_MIN
produced an implicit conversion to a huge size_t and an allocation request that
fails with an uncaught std::length_error -- which escapes the catch clauses in
TConnectedClient::run() and Thread::threadMain(), crashing the whole server
process (TSimpleServer/TThreadedServer/TThreadPoolServer; TNonblockingServer is
unaffected due to broader exception handling); (2) independently, the bounds
check compared the length against the remaining header space before advancing
past the length varint itself, allowing a small bounded over-read past the
header boundary.
Fixed by rejecting negative lengths and bounding the length against the
post-varint position instead of the pre-varint position.
*Affects:* C++; fixed in 0.24.0
*Fixed by:* PR #3610
*CWE-1284 / CWE-125:* Improper Validation of Specified Quantity in Input /
Out-of-bounds Read
*CVSS 4.0:* 8.7 High
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
*Reported by:* found and fixed by Javid Khan (PR #3610)
*CVE:* CVE-2026-58662
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
