Integer Overflow or Wraparound Affecting com.squareup.wire:wire-runtime package, versions [,6.4.5)[7.0.0-alpha01,7.0.0-alpha04)

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field with a large positive 32-bit length, which overflows the reader’s cursor math when limit = pos + length is computed during ProtoAdapter.decode(ByteArray) or ProtoAdapter.decode(ByteString). Malformed input can turn what should be a normal decode failure into unchecked runtime exceptions such as IllegalArgumentException or ArrayIndexOutOfBoundsException. Applications that decode attacker-controlled protobuf bytes can be taken down by a single short payload.

Workarounds

• Reject attacker-controlled protobuf payloads at the service boundary before passing them to Wire, or cap the maximum message size so oversized length-delimited fields cannot reach ProtoAdapter.decode(ByteArray) / ProtoAdapter.decode(ByteString).
• Prefer decoding from a bounded source instead of unbounded attacker-controlled byte arrays, which limits the impact of malformed length-delimited input that can otherwise trigger a crash.
• Treat unchecked runtime exceptions from protobuf decoding as malformed-input failures and contain them at the trust boundary, so a bad payload cannot terminate request handling or the process.

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release
• Maintainer's Advisory