It was discovered that the qpid::framing::Buffer::checkAvailable() function could crash due to a wraparound.  The function looks like this:

  void checkAvailable(uint32_t count)
      { if (position + count > size) throw OutOfBounds(); }

where position + count can overflow, resulting in a value which is smaller than size.  The put*String() functions contain potential wraparounds in the argument to checkAvailable().


Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.