Integer Overflow or Wraparound Affecting github.com/square/wire package, versions <6.4.5>=7.0.0-alpha01 <7.0.0-alpha04

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field with a large positive 32-bit length, which overflows the reader’s cursor math when limit = pos + length is computed during ProtoAdapter.decode(ByteArray) or ProtoAdapter.decode(ByteString). Malformed input can turn what should be a normal decode failure into unchecked runtime exceptions such as IllegalArgumentException or ArrayIndexOutOfBoundsException. Applications that decode attacker-controlled protobuf bytes can be taken down by a single short payload.

Workarounds

• Reject attacker-controlled protobuf payloads at the service boundary before passing them to Wire, or cap the maximum message size so oversized length-delimited fields cannot reach ProtoAdapter.decode(ByteArray) / ProtoAdapter.decode(ByteString).
• Prefer decoding from a bounded source instead of unbounded attacker-controlled byte arrays, which limits the impact of malformed length-delimited input that can otherwise trigger a crash.
• Treat unchecked runtime exceptions from protobuf decoding as malformed-input failures and contain them at the trust boundary, so a bad payload cannot terminate request handling or the process.

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release
• Maintainer's Advisory