Skip to content

snappy: read frame length as 3 bytes to avoid OOB at boundary [Backport to 4.2] #11901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cosmo0920 merged 1 commit into from
Jun 3, 2026
+3 −2
Merged

snappy: read frame length as 3 bytes to avoid OOB at boundary [Backport to 4.2] #11901

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions src/flb_snappy.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,8 +170,9 @@ int flb_snappy_uncompress_framed_data(char *in_data, size_t in_len,

frame_type = *((uint8_t *) &frame_buffer[0]);

frame_length = *((uint32_t *) &frame_buffer[1]);
frame_length &= 0x00FFFFFF;
frame_length = ((uint32_t)((unsigned char) frame_buffer[1])) |
((uint32_t)((unsigned char) frame_buffer[2]) << 8) |
((uint32_t)((unsigned char) frame_buffer[3]) << 16);
Comment on lines +173 to +175
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Reject truncated frame headers before reading length

For malformed framed snappy input with fewer than 4 bytes remaining (for example an HTTP/Prometheus/OTel request body that starts with the stream-identifier byte but is only 1–3 bytes long, or has a 1–3 byte trailing frame), while (offset < in_len) still enters the loop and these byte loads read past the supplied buffer. The previous unaligned 32-bit load was narrowed, but the frame header still needs an in_len - offset >= 4 check before reading frame_buffer[1..3].

Useful? React with 👍 / 👎.


frame_body = &frame_buffer[4];

Expand Down
Loading