kakkar87d opened a new pull request, #453: URL: https://github.com/apache/qpid-proton/pull/453
**32-bit integer overflow in the AMQP consumer length checks** `pni_consumer_readv32` and the 4-octet variable-width case in `pni_consumer_read_value_not_described` validate a wire-supplied 32-bit length with `position + size > size`. On an ILP32 target (`size_t` is 32 bits) that addition wraps, so a length close to `UINT32_MAX` passes the check and the consumer returns a `pn_bytes_t` that points at a few bytes but claims up to 4 GiB, which the caller then reads past the buffer. These consumers parse SASL mechanism/init frames and transport performatives, so the length is attacker controlled before authentication. Rewritten to the non-overflowing form already used by `pn_decoder_remaining`, comparing the length against the bytes actually remaining (`consumer->position <= consumer->size` always holds at these points). The nearby `uint8` and fixed-width checks cannot overflow for any real buffer and are left unchanged. Verified on a 32-bit armhf build: a crafted length of `0xFFFFFFFF` against a 16-byte buffer was accepted before the change and rejected after. The full build, `c-core-test`, the codec/message/value/interop tests and the `fuzz-connection-driver`/`fuzz-message-decode` regression corpora all pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
