[
https://issues.apache.org/jira/browse/THRIFT-6094?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6094.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Copy buffered data not the GByteArray struct in c_glib read_slow
> ----------------------------------------------------------------
>
> Key: THRIFT-6094
> URL: https://issues.apache.org/jira/browse/THRIFT-6094
> Project: Thrift
> Issue Type: Bug
> Components: C glib - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> thrift_buffered_transport_read_slow() and thrift_framed_transport_read_slow()
> each handle a leftover-bytes path with memcpy(buf, t->r_buf, have). t->r_buf
> is a GByteArray*, so this copied the struct's own fields (a heap pointer and
> a length integer) into the caller's decode buffer rather than the intended
> payload bytes; when more than sizeof(GByteArray) bytes were leftover, the
> copy additionally read past the end of the struct into adjacent heap memory,
> which could then surface in decoded message fields.
> Fixed by copying from t->r_buf->data (the pattern already used everywhere
> else in both files) instead of t->r_buf.
> *Affects:* c_glib (ThriftBufferedTransport, ThriftFramedTransport); fixed in
> 0.24.0
> *Fixed by:* PR #3607 (commit f20a320c2), merged 2026-06-27
> *CWE-125:* Out-of-bounds Read
> *CVSS 4.0:* 6.9 Medium
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N}})
> *Reported by:* found and fixed by Javid Khan (PR #3607)
> *CVE:* CVE-2026-58023
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
