MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

Summary

MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to int without validation. A rogue or MitM server can send a value above Integer.MAX_VALUE whose truncation becomes a negative or arbitrary length.

Details

The protocol encodes lengths as length-encoded integers, whose 8-byte form the decoder (readLength() and readIntLengthEncodedNotNull()) returned as (int) readLong(). A value above Integer.MAX_VALUE therefore wrapped to a negative or unrelated int, used afterwards as a length to size allocations or reads, which ended in NegativeArraySizeException, out-of-bounds exceptions or oversized allocations.

The fix rejects any length-encoded value that does not fit a non-negative int with an explicit error.

Impact

Availability only: a malicious or compromised server, or a MitM, can crash the client's connection handling with unchecked exceptions or drive oversized allocations. Exploitation requires control of the server side of the connection; no authentication bypass, confidentiality or integrity impact.

Credit

Reported by fg0x0