jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
Impact
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value >> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.
Source excerpt · HeroDevsAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
FasterXML · jackson-dataformat-smile
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 2.9.0 to before 2.18.12 | affected |
| 2.18.12 | unaffected |
| 2.19.0 to before 2.21.8 | affected |
| 2.21.8 | unaffected |
| 2.22.0 to before 2.22.4 | affected |
| 2.22.4 | unaffected |
FasterXML · jackson-dataformat-smile
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 3.0.0 to before 3.1.8 | affected |
| 3.1.8 | unaffected |
| 3.2.0 to before 3.2.4 | affected |
| 3.2.4 | unaffected |
Original source description
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.
A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.
This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.