[jira] [Resolved] (THRIFT-6092) Fix off-by-ten header bounds check in readHeaderFormat

["Jens Geyer (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/THRIFT-6092?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jens Geyer resolved THRIFT-6092.
--------------------------------
      Assignee: Jens Geyer
    Resolution: Fixed

> Fix off-by-ten header bounds check in readHeaderFormat
> ------------------------------------------------------
>
>                 Key: THRIFT-6092
>                 URL: https://issues.apache.org/jira/browse/THRIFT-6092
>             Project: Thrift
>          Issue Type: Bug
>          Components: C++ - Library
>            Reporter: Jens Geyer
>            Assignee: Jens Geyer
>            Priority: Major
>             Fix For: 0.24.0
>
>
> THeaderTransport::readHeaderFormat() bounded the declared header size against the wrong reference point (if (headerSize > sz)), allowing a read of up to 10 bytes past the end of the buffer.
> Fixed by tightening the check to if (headerSize > sz - 10).
> *Affects:* C++, confirmed present in 0.23.0 (buggy check at line 209); fixed in 0.24.0
> *Fixed by:* PR #3597 (commits 4da36faee, ae251547b)
> *CWE-126:* Buffer Over-read
> *CVSS 4.0:* 6.9 Medium ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N}})
> *Reported by:* Ghaith Abdulreda, via security@apache.org; fix contributed by Javid Khan, with test infrastructure by Jens Geyer
> *CVE:* CVE-2026-55970



--
This message was sent by Atlassian Jira
(v8.20.10#820010)