It was discovered that the qpid::framing::Buffer::checkAvailable() function could crash due to a wraparound. The function looks like this:
void checkAvailable(uint32_t count)
{ if (position + count > size) throw OutOfBounds(); }
where position + count can overflow, resulting in a value which is smaller than size. The put*String() functions contain potential wraparounds in the argument to checkAvailable().
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
It was discovered that the qpid::framing::Buffer::checkAvailable() function could crash due to a wraparound. The function looks like this: void checkAvailable(uint32_t count) { if (position + count > size) throw OutOfBounds(); } where position + count can overflow, resulting in a value which is smaller than size. The put*String() functions contain potential wraparounds in the argument to checkAvailable(). Acknowledgements: This issue was discovered by Florian Weimer of the Red Hat Product Security Team.