[jira] [Work logged] (ARTEMIS-3593) OOM error on rogue message to Artemis Broker

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ARTEMIS-3593?focusedWorklogId=689182&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-689182 ]

ASF GitHub Bot logged work on ARTEMIS-3593:
-------------------------------------------

                Author: ASF GitHub Bot
            Created on: 02/Dec/21 11:01
            Start Date: 02/Dec/21 11:01
    Worklog Time Spent: 10m 
      Work Description: vkolomeyko commented on pull request #3862:
URL: https://github.com/apache/activemq-artemis/pull/3862#issuecomment-984520626


   > I am refactoring the safeRead into BytebufferUtil BTW. so we can reuse the method in other packets
   
   @clebertsuconic - sure. Please feel free to add me as a reviewer as soon as you have PR ready.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

    Worklog Id:     (was: 689182)
    Time Spent: 1.5h  (was: 1h 20m)

> OOM error on rogue message to Artemis Broker
> --------------------------------------------
>
>                 Key: ARTEMIS-3593
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-3593
>             Project: ActiveMQ Artemis
>          Issue Type: Bug
>          Components: Broker
>    Affects Versions: 2.6.2
>            Reporter: Viktor Kolomeyko
>            Priority: Critical
>             Fix For: 2.20.0
>
>         Attachments: CrashDump.log, dospayload.binary
>
>          Time Spent: 1.5h
>  Remaining Estimate: 0h
>
> A problem been reported by a Security Researcher when a Java process running an embedded Artemis Broker been sent a handcrafted message:
> {code:sh}
> cat /path/to/dospayload.binary > /dev/tcp/<broker_address>/<broker_port>{code}
> resulting OutOfMemory crash, please see attachment.
> The problem is caused by the fact that a 32-bit integer is read from the stream and byte array is allocated using this value without performing any checks.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)