GHSA-xqrx-qh46-34m7: Out-of-bounds Read
Impact Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, and therefore the typed-array write/read methods, pass caller-supplied ranges to this method.
Patches Fixed in 1.1.10.9 (#741). Snappy.arrayCopy checks both ranges before copying. The stream read/write methods validate offsets and lengths, and reject typed-array ranges whose byte size overflows int.
Workarounds Validate offsets and lengths before calling these methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xerial.snappy:snappy-javato a version that resolves this vulnerability.Fixed in 1.1.10.9 - Upgrade
Upgrade
Snappyto a version that resolves this vulnerability.Fixed in 1.1.10.9Patch #741 - Compensating control
Validate offsets and lengths before calling the stream read/write methods, including rejecting typed-array ranges whose byte size overflows int.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using snappy-java are exposed when they call Snappy.arrayCopy, SnappyOutputStream.rawWrite, SnappyInputStream.rawRead, or the typed-array write/read methods with offsets or lengths that can be influenced by untrusted input.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to cause a vulnerable method to receive a negative or oversized offset or byte length. Exploitation can read or write outside the array bounds and crash the JVM.
Are the affected methods safe by default?
No. The vulnerable array-copy and stream methods passed caller-supplied ranges to native memcpy without validating them. Callers must ensure offsets and lengths are valid unless they upgrade to the fixed release.
What can be done if upgrading is not immediately possible?
Validate offsets and lengths before calling Snappy.arrayCopy, rawWrite, rawRead, or typed-array read/write methods. Reject negative values and ranges that exceed the relevant array bounds; for typed arrays, also reject ranges whose byte size overflows int.
Which release fixes the issue?
The issue is fixed in snappy-java 1.1.10.9. The fix adds range checks to array copying and stream reads and writes.