Medium, CVSS 6.5PyPIAmendedPublished
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
GHSA-7fqq-q52p-2jjg
- Affected
- PyPI opencc < 1.2.0
- Fixed in
- 1.2.0· Vendor fix available
- Issue
- OpenCC versions before 1.2.0 contain two CWE-125: Out-of-bounds Read issues caused by length validation failures in UTF-8 processing. When handling malformed or truncated UTF-8 input, OpenCC trusted derived length values without enforcing the invariant that processed length must not exceed the remaining input buffer. This could result in out-of-bounds reads during segmentation or conversion. Details Two independent code paths in OpenCC failed to enforce the invariant: matchedLength <= remainingLength Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain: invalid UTF-8 - incorrect derived length - incorrect pointer advance - remaining-length desynchronization - out-of-bounds read In MaxMatchSegmentation::Segment, this could desynchronize remaining-length tracking and cause out-of-bounds reads during prefix matching. In Conversion::Convert(const…
Recommended action: Upgrade to 1.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.