From 5fa8ed760437453c7694ce9e8bd76d21e2f5d683 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 17 Jul 2026 11:16:45 +0000
Subject: [PATCH] CVE-2026-62375 Unbounded VLV offset array allocation leading to memory-exhaustion DoS
---
opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/EntryContainer.java | 27 ++++++++++++++++++---------
1 files changed, 18 insertions(+), 9 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/EntryContainer.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/EntryContainer.java
index a4a7eb2..04827b4 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/EntryContainer.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/EntryContainer.java
@@ -14,6 +14,7 @@
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
* Portions copyright 2013 Manuel Gaupp
+ * Portions Copyright 2026 3A Systems, LLC
*/
package org.opends.server.backends.pluggable;
@@ -2688,21 +2689,29 @@
afterCount = 0;
}
- int count = 1 + beforeCount + afterCount;
+ // Never allocate more longs than the number of entries actually available
+ // from startPos, and compute the size with long arithmetic so an
+ // attacker-supplied before/after count cannot overflow or drive an oversized
+ // array (GHSA-q4wx-wj4j-4657).
+ final int available = startPos >= 0 && startPos < sortMap.size() ? sortMap.size() - startPos : 0;
+ final int count = (int) Math.max(0L, Math.min(1L + beforeCount + afterCount, available));
long[] sortedIDs = new long[count];
int treePos = 0;
int arrayPos = 0;
- for (EntryID id : sortMap.values())
+ if (count > 0)
{
- if (treePos++ < startPos)
+ for (EntryID id : sortMap.values())
{
- continue;
- }
+ if (treePos++ < startPos)
+ {
+ continue;
+ }
- sortedIDs[arrayPos++] = id.longValue();
- if (arrayPos >= count)
- {
- break;
+ sortedIDs[arrayPos++] = id.longValue();
+ if (arrayPos >= count)
+ {
+ break;
+ }
}
}
--
Gitblit v1.10.0