[
https://issues.apache.org/jira/browse/THRIFT-6096?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6096.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Fix info-header string bound check in THeaderTransport::readString
> ------------------------------------------------------------------
>
> Key: THRIFT-6096
> URL: https://issues.apache.org/jira/browse/THRIFT-6096
> Project: Thrift
> Issue Type: Bug
> Components: C++ - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> THeaderTransport::readString() (used while parsing THeader info-header
> key/value strings) read a length-prefixed string with two independent defects
> in the pre-fix code: (1) the declared length was a signed 32-bit value with
> no rejection of negative values, so a crafted 5-byte varint decoding to
> INT32_MIN produced an implicit conversion to a huge size_t and an allocation
> request that fails with an uncaught std::length_error -- which escapes the
> catch clauses in TConnectedClient::run() and Thread::threadMain(), crashing
> the whole server process (TSimpleServer/TThreadedServer/TThreadPoolServer;
> TNonblockingServer is unaffected due to broader exception handling); (2)
> independently, the bounds check compared the length against the remaining
> header space before advancing past the length varint itself, allowing a small
> bounded over-read past the header boundary.
> Fixed by rejecting negative lengths and bounding the length against the
> post-varint position instead of the pre-varint position.
> *Affects:* C++; fixed in 0.24.0
> *Fixed by:* PR #3610
> *CWE-1284 / CWE-125:* Improper Validation of Specified Quantity in Input /
> Out-of-bounds Read
> *CVSS 4.0:* 8.7 High
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
> *Reported by:* found and fixed by Javid Khan (PR #3610)
> *CVE:* CVE-2026-58662
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
