GHSA-xqrx-qh46-34m7medium5.9

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

The advisory, in context

Impact

Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, and therefore the typed-array write/read methods, pass caller-supplied ranges to this method.

Patches

Fixed in 1.1.10.9 (#741). Snappy.arrayCopy checks both ranges before copying. The stream read/write methods validate offsets and lengths, and reject typed-array ranges whose byte size overflows int.

Workarounds

Validate offsets and lengths before calling these methods.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

org.xerial.snappy:snappy-java Maven

Ecosystem versions

Earlier releases before 1.1.10.9

Fixed in 1.1.10.9

83 explicitly affected versions

1.0.1-rc1, 1.0.1-rc2, 1.0.1-rc3, 1.0.1-rc4, 1.0.3, 1.0.3-rc1, 1.0.3-rc2, 1.0.3-rc3, 1.0.3-rc4, 1.0.3.1, 1.0.3.2, 1.0.3.3, 1.0.4, 1.0.4.1, 1.0.5, 1.0.5-M1, 1.0.5-M2, 1.0.5-M3, 1.0.5-M4, 1.0.5.1, 1.0.5.2, 1.0.5.3, 1.0.5.4, 1.1.0, 1.1.0-M1, 1.1.0-M2, 1.1.0-M3, 1.1.0-M4, 1.1.0.1, 1.1.1, 1.1.1-M1, 1.1.1-M2, 1.1.1-M3, 1.1.1-M4, 1.1.1.1, 1.1.1.2, 1.1.1.3, 1.1.1.4, 1.1.1.5, 1.1.1.6, 1.1.1.7, 1.1.10.0, 1.1.10.1, 1.1.10.2, 1.1.10.3, 1.1.10.4, 1.1.10.5, 1.1.10.6, 1.1.10.7, 1.1.10.8, 1.1.2, 1.1.2-M1, 1.1.2-RC1, 1.1.2-RC2, 1.1.2-RC3, 1.1.2.1, 1.1.2.2, 1.1.2.3, 1.1.2.4, 1.1.2.5, 1.1.2.6, 1.1.3-M1, 1.1.3-M2, 1.1.4, 1.1.4-M1, 1.1.4-M2, 1.1.4-M3, 1.1.7, 1.1.7.1, 1.1.7.2, 1.1.7.3, 1.1.7.4, 1.1.7.5, 1.1.7.6, 1.1.7.7, 1.1.7.8, 1.1.8, 1.1.8.1, 1.1.8.2, 1.1.8.3, 1.1.8.4, 1.1.9.0, 1.1.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.1.10.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.0.1-rc1",
    "1.0.1-rc2",
    "1.0.1-rc3",
    "1.0.1-rc4",
    "1.0.3",
    "1.0.3-rc1",
    "1.0.3-rc2",
    "1.0.3-rc3",
    "1.0.3-rc4",
    "1.0.3.1",
    "1.0.3.2",
    "1.0.3.3",
    "1.0.4",
    "1.0.4.1",
    "1.0.5",
    "1.0.5-M1",
    "1.0.5-M2",
    "1.0.5-M3",
    "1.0.5-M4",
    "1.0.5.1",
    "1.0.5.2",
    "1.0.5.3",
    "1.0.5.4",
    "1.1.0",
    "1.1.0-M1",
    "1.1.0-M2",
    "1.1.0-M3",
    "1.1.0-M4",
    "1.1.0.1",
    "1.1.1",
    "1.1.1-M1",
    "1.1.1-M2",
    "1.1.1-M3",
    "1.1.1-M4",
    "1.1.1.1",
    "1.1.1.2",
    "1.1.1.3",
    "1.1.1.4",
    "1.1.1.5",
    "1.1.1.6",
    "1.1.1.7",
    "1.1.10.0",
    "1.1.10.1",
    "1.1.10.2",
    "1.1.10.3",
    "1.1.10.4",
    "1.1.10.5",
    "1.1.10.6",
    "1.1.10.7",
    "1.1.10.8",
    "1.1.2",
    "1.1.2-M1",
    "1.1.2-RC1",
    "1.1.2-RC2",
    "1.1.2-RC3",
    "1.1.2.1",
    "1.1.2.2",
    "1.1.2.3",
    "1.1.2.4",
    "1.1.2.5",
    "1.1.2.6",
    "1.1.3-M1",
    "1.1.3-M2",
    "1.1.4",
    "1.1.4-M1",
    "1.1.4-M2",
    "1.1.4-M3",
    "1.1.7",
    "1.1.7.1",
    "1.1.7.2",
    "1.1.7.3",
    "1.1.7.4",
    "1.1.7.5",
    "1.1.7.6",
    "1.1.7.7",
    "1.1.7.8",
    "1.1.8",
    "1.1.8.1",
    "1.1.8.2",
    "1.1.8.3",
    "1.1.8.4",
    "1.1.9.0",
    "1.1.9.1"
  ]
}

Set up in your agent.

Investigate in your agent.