Integer Overflow or WraparoundAffected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field with a large positive 32-bit length, which overflows the reader’s cursor math when limit = pos + length is computed during ProtoAdapter.decode(ByteArray) or ProtoAdapter.decode(ByteString). Malformed input can turn what should be a normal decode failure into unchecked runtime exceptions such as IllegalArgumentException or ArrayIndexOutOfBoundsException. Applications that decode attacker-controlled protobuf bytes can be taken down by a single short payload.
Workarounds
- Reject attacker-controlled protobuf payloads at the service boundary before passing them to Wire, or cap the maximum message size so oversized length-delimited fields cannot reach
ProtoAdapter.decode(ByteArray) / ProtoAdapter.decode(ByteString).
- Prefer decoding from a bounded source instead of unbounded attacker-controlled byte arrays, which limits the impact of malformed length-delimited input that can otherwise trigger a crash.
- Treat unchecked runtime exceptions from protobuf decoding as malformed-input failures and contain them at the trust boundary, so a bad payload cannot terminate request handling or the process.
How to fix Integer Overflow or Wraparound? Upgrade com.squareup.wire:wire-runtime to version 6.4.5, 7.0.0-alpha04 or higher.
| [,6.4.5)[7.0.0-alpha01,7.0.0-alpha04) |
Improper Validation of Array IndexAffected versions of this package are vulnerable to Improper Validation of Array Index in the skipGroup function. An attacker can cause a service crash by sending a crafted protobuf payload with a negative length in a length-delimited field inside a group, leading to an unchecked runtime exception that escapes the documented error handling.
How to fix Improper Validation of Array Index? Upgrade com.squareup.wire:wire-runtime to version 6.3.0, 7.0.0-alpha03 or higher.
| [,6.3.0)[7.0.0-alpha01,7.0.0-alpha03) |
