GHSA-pgrf-4654-3gq8 — netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

Affected: Maven: io.netty.incubator:netty-incubator-codec-bhttp

## Summary

`io.netty.incubator:netty-incubator-codec-bhttp` uses attacker-controlled Binary HTTP variable-length integers as `long` values but accumulates them into `int` offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked `ArrayIndexOutOfBoundsException` / `IndexOutOfBoundsException` from a tiny malformed BHTTP payload. A remote peer can trigger connection-level denial of service in applications that expose `BinaryHttpParser` / `BinaryHttpDecoder` to untrusted input.

## Details

In `codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java`, several parser paths store cumulative byte offsets in `int sumBytes` and then add attacker-controlled `long` lengths using compound assignment. In Java, `int += long` narrows the result back to `int`, so a length such as `2^31` wraps `sumBytes` negative.

Primary request-control-data path:

- `readRequestHead(...)` declares `int sumBytes = 0` at `BinaryHttpParser.java:386`. - It reads `methodLength` as a `long` at `BinaryHttpParser.java:394`. - It performs `sumBytes += methodLength` at `BinaryHttpParser.java:395`, narrowing the result to `int`. - If `methodLength` is `2^31`, `sumBytes` wraps negative and bypasses `if (sumBytes >= in.readableBytes()) return null` at `BinaryHttpParser.java:396-398`. - The parser then computes `schemeLengthIdx = in.readerIndex() + sumBytes` and calls `in.getByte(schemeLengthIdx)` at `BinaryHttpParser.java:401-402`, producing a negative index ex…

Most recent entries from all

GHSA-pgrf-4654-3gq8 — netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash