Mojira Archive
MC-166512

Data size check in ByteArrayTag, IntArrayTag and LongArrayTag can overflow, allowing DOS

The bug

The data size checks in ByteArrayTag, IntArrayTag and LongArrayTag (Mojang names) can overflow, allowing allocating huge arrays, potentially causing a DOS.
An attacker can exploit this using one of the following packets which deserialize item data:

  • ServerboundContainerClickPacket
  • ServerboundEditBookPacket
  • ServerboundSetCreativeModeSlotPacket

Since this happens before any validation of the packet data occurs there are no requirements except that the player has to have joined the server successfully. An adversary could probably make such a DOS attack more effectively

  • by not requesting too large arrays, otherwise the server fails fast with an OutOfMemoryError
  • by sending the data for the array elements really slow (but fast enough to not trigger a timeout), otherwise the server fails fast because no / too less array elements are sent (?)

The cause for the overflow it the same for all classes, shown here for LongArrayTag:

LongArrayTag
public LongArrayTag load(DataInput dataInput, int n, NbtAccounter nbtAccounter) throws IOException {
    nbtAccounter.accountBits(192L);
    int n2 = dataInput.readInt();
    // accountBits accepts a long, however since both 64 and n2 are ints,  
    // the result can overflow first
    // To fix this, make one of them a long, e.g.: 64L * n2
    nbtAccounter.accountBits(64 * n2);
    long[] arrl = new long[n2];
    for (int i = 0; i < n2; ++i) {
        arrl[i] = dataInput.readLong();
    }
    return new LongArrayTag(arrl);
}

Fixed

Marcono1234

[Mojang] slicedlime

2019-11-26, 06:06 PM

2019-12-06, 01:37 PM

2019-12-06, 01:37 PM

1

1

Confirmed

Very Important

Networking

mojang_internal_2

1.14.4, 1.15 Pre-Release 2

1.15 Pre-release 6