GHSA-r3rc-9hpw-54v9

Summary

A program using swift-nio is vulnerable to a potential out-of-bounds write when attacker-controlled index or length values exceeding UInt32.max are passed to some ByteBuffer methods. This affects all swift-nio versions from 1.0.0 to 2.99.0. It is fixed in 2.100.0 and later releases.

Details

ByteBuffer internally stores indices and capacities as UInt32 values. The internal helper functions _toIndex and _toCapacity, which convert from Int to UInt32, used UInt32(truncatingIfNeeded:). On 64-bit platforms, this silently discards the upper 32 bits of the value rather than trapping on overflow. For example, a value of UInt32.max + 1 (0x100000000) would be truncated to 0.

This truncation can cause safety preconditions to pass when they should fail. Subsequent operations would then use the incorrect truncated value, potentially leading to out-of-bounds memory writes or reads.

The affected ByteBuffer methods that may lead to out-of-bounds writes are:

• copyBytes(at:to:length:) — a crafted destination index exceeding UInt32.max could copy bytes to an incorrect offset.
• writeWithUnsafeMutableBytes(minimumWritableBytes:) — a crafted minimumWritableBytes exceeding UInt32.max could provide the caller with a buffer pointer of incorrect length, which can easily be subsequently overflowed.

The affected ByteBuffer methods that have logic errors but do neither expose out-of-bounds reads nor out-of-bounds writes:

• moveReaderIndex(forwardBy:) / moveWriterIndex(forwardBy:) — a crafted offset exceeding UInt32.max could move indices to incorrect positions, bypassing bounds checks. These indices cannot be out of the bounds of the buffer, so they do not expose access to uninitialized memory or produce wild pointers.
• The ByteBuffer(takingOwnershipOf:allocator:) initialiser — passing a buffer larger than UInt32.max bytes could create a ByteBuffer with an incorrect capacity.

Outside of these methods, there are...