MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

Summary

XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and bqual_length columns returned by XA RECOVER to allocate and split each Xid.

Details

MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of the recovery list by allocating new byte[gtrid_length] and new byte[bqual_length] and copying from the data column, without validating the lengths against the XA specification bounds (Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE) or the actual payload. Negative or oversized lengths, or lengths that do not fit the data, ended in large allocations or unchecked exceptions (NegativeArraySizeException, ArrayIndexOutOfBoundsException) during recovery.

The fix validates the lengths before any allocation or copy and reports an invalid row as an XAException (XAER_RMFAIL).

Impact

Availability only, and limited to applications running XA recovery: a malicious or compromised server, or a MitM, can crash the recovery or drive large allocations. Exploitation requires control of the server side of the connection.

Credit

Reported by fg0x0