Mojira Archive
MC-257599

CompressionDecoder does not verify that expected number of bytes have been inflated

Based on Mojang names for 22w45a

The class net.minecraft.network.CompressionDecoder does not verify that the bytes it inflated actually match the expected number of bytes. It should verify that the return value of java.util.zip.Inflater.inflate actually matches the number of expected bytes.

It looks like this is currently not causing any direct problems (assuming requests are wellformed) and is not exploitable, but fixing this would make the code more robust, especially in case the code is refactored in the future to pool the buffers (or similar) since that could then leak content from previous requests.
Additionally as pointed out by JDK-8283758, the remainder of the buffer array may contain arbitrary data after calling inflate.

As unrelated side note: Neither CompressionEncoder nor CompressionDecoder call Deflater.end() / Inflater.end() to release resources in a timely manner. Not sure if that is a big issue though.

Invalid

Marcono1234

2022-11-15, 10:35 PM

2022-11-16, 08:15 AM

2022-11-16, 08:15 AM

2

5

Plausible

Networking

22w45a

-