Summary
An integer overflow vulnerability exists in the C++ implementation of FlatBufferBuilder. When allocating space for vectors using functions such as CreateUninitializedVector or make_space, the library performs a multiplication of the requested number of elements by the element size without checking for integer overflow.
This allows an attacker to supply a maliciously crafted length value, resulting in a tiny memory allocation on the heap, followed by a massive Heap Out-of-Bounds Write (Heap Smash) when the application attempts to write the expected number of elements.
Proof of Concept (PoC) & Fuzzing
I have written a standalone OSS-Fuzz target that reliably reproduces this memory corruption using libFuzzer and ASan.
- OSS-Fuzz Integration: The fuzzer has been officially reviewed and approved by the OSS-Fuzz maintainers in PR
google/oss-fuzz#15927.
Proposed Fix / Patch
I have already submitted a comprehensive patch that safely implements mathematical boundary checks across all allocation paths to eliminate this vulnerability class.
Disclosure Context
This issue was originally reported to the Google OSS Vulnerability Reward Program (Ticket #525724852). After review, the VRP team authorized the public disclosure of this vulnerability on this repository.
Given the severe downstream impact on systems relying on FlatBufferBuilder for handling untrusted data, I strongly urge the maintainers to review and merge the existing patch (PR #9145) to secure the codebase.
Summary
An integer overflow vulnerability exists in the C++ implementation of
FlatBufferBuilder. When allocating space for vectors using functions such asCreateUninitializedVectorormake_space, the library performs a multiplication of the requested number of elements by the element size without checking for integer overflow.This allows an attacker to supply a maliciously crafted length value, resulting in a tiny memory allocation on the heap, followed by a massive Heap Out-of-Bounds Write (Heap Smash) when the application attempts to write the expected number of elements.
Proof of Concept (PoC) & Fuzzing
I have written a standalone OSS-Fuzz target that reliably reproduces this memory corruption using libFuzzer and ASan.
google/oss-fuzz#15927.Proposed Fix / Patch
I have already submitted a comprehensive patch that safely implements mathematical boundary checks across all allocation paths to eliminate this vulnerability class.
Disclosure Context
This issue was originally reported to the Google OSS Vulnerability Reward Program (Ticket #525724852). After review, the VRP team authorized the public disclosure of this vulnerability on this repository.
Given the severe downstream impact on systems relying on
FlatBufferBuilderfor handling untrusted data, I strongly urge the maintainers to review and merge the existing patch (PR #9145) to secure the codebase.