[ACCUMULO-1986] Validity checks missing for readFields and Thrift deserialization

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.5, 1.5.1, 1.6.0
• Labels: serialization thrift validation
• Assignee: Bill Havanki
• Reporter: Bill Havanki
• Created: 09/Dec/13 15:51
• Updated: 18/Dec/13 14:54
• Resolved: 18/Dec/13 14:54

Description

Classes in o.a.a.core.data (and potentially elsewhere) that support construction from a Thrift object and/or population from a DataInput (via a readFields() method) often lack data validity checks that the classes' constructors enforce. The missing checks make it possible for an attacker to create invalid objects by manipulating the bytes being read. The situation is analogous to the need to check objects deserialized from their Java serialized form within the readObject() method.

Issue Links

• links to: Review / patch