Missing bounds checks in the Odin compress component allow an out-of-bounds write and memory corruption
An attacker can craft a malicious compressed stream, such as a truncated DEFLATE stream or a patterned zero-byte stream, so that zlib.inflate or gzip.load keeps writing after the internal buffer has grown to the COMPRESS_OUTPUT_ALLOCATE_MAX limit. grow_buffer does not return an error when that limit is reached, and lower-level writes such as write_byte skip further length checks and have bounds checking disabled, so data is written past the heap block. The resulting heap buffer overflow can cause denial of service, arbitrary code execution, or disclosure of sensitive information.
Component
Odin is a systems programming language and its standard-library collection. The core/compress module provides efficient streaming and buffered compression and decompression for applications. It handles variable-length input and output streams through dynamic memory management, aiming for high-performance Zlib and Gzip compatibility while keeping conversion overhead low in resource-constrained environments.
Type
Out-of-bounds Write (CWE-787)
Repo
github.com/odin-lang/Odin
Stars 12274
Remediation
- Add a strict ceiling check to buffer growth so that reaching the preset maximum returns an error immediately instead of failing silently; re-validate remaining space before every low-level write and abort with an error when space is insufficient; also remove the critical #no_bounds_check compiler directive so the default runtime safety checks stay enabled.
