From 5fa8ed760437453c7694ce9e8bd76d21e2f5d683 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 17 Jul 2026 11:16:45 +0000
Subject: [PATCH] CVE-2026-62375 Unbounded VLV offset array allocation leading to memory-exhaustion DoS
---
opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/VLVIndex.java | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/VLVIndex.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/VLVIndex.java
index 2b96e9f..757aa99 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/VLVIndex.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/VLVIndex.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2008 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC
*/
package org.opends.server.backends.pluggable;
@@ -689,7 +690,12 @@
}
final long[] selectedIDs;
- final int count = 1 + beforeCount + afterCount;
+ // Never allocate more longs than the number of entries actually available
+ // from startPos, and compute the size with long arithmetic so an
+ // attacker-supplied before/after count cannot overflow or drive an oversized
+ // array (GHSA-q4wx-wj4j-4657).
+ final int available = startPos >= 0 && startPos < currentCount ? currentCount - startPos : 0;
+ final int count = (int) Math.max(0L, Math.min(1L + beforeCount + afterCount, available));
try (Cursor<ByteString, ByteString> cursor = txn.openCursor(getName()))
{
if (cursor.positionToIndex(startPos))
--
Gitblit v1.10.0