REDHAT-BUG-2491620: Integer Overflow

JBoss EAP's IIOP (Internet Inter-ORB Protocol) subsystem processes security tokens from CORBA clients as part of the CSIv2 (Common Secure Interoperability version 2) handshake. This processing happens before any authentication — triggered by a portable interceptor (SASTargetInterceptor) that fires on every single incoming IIOP request. Two methods in CSIv2Util.java read a length field directly from the attacker-controlled network packet and immediately allocate a Java byte array of that size — with zero bounds checking:

A single unauthenticated GIOP packet with a crafted length field can cause: - OutOfMemoryError — the JVM attempts a ~2 GB heap allocation and crashes - NegativeArraySizeException — integer overflow in the length field kills the worker thread - Both outcomes are repeatable — the attacker can sustain the DoS by sending packets in a loop