[Security Disclosure] MAP32 Integer Overflow in skipValue() — Cursor Desynchronization #1014

Impact

Parser state desynchronization from a silent skipValue() failure. After the overflow, the map body is not consumed. A subsequent read from the same stream consumes bytes intended to be skipped.

Affected applications use MessageUnpacker directly and call skipValue() to skip unknown fields before reading later fields (forward-compatible RPC frameworks, game servers, IoT gateways). The Jackson integration (MessagePackParser) does not call skipValue() and is unaffected.

Remediation

Use overflow-safe arithmetic:

case MAP32: {
    long mapSize = readNextLength32();
    long added = Math.multiplyExact(mapSize, 2L);
    if (added > Integer.MAX_VALUE - count) {
        throw new MessageSizeException("MAP32 size overflow", mapSize);
    }
    count = (int)(count + added);
    break;
}

Apply the same fix to the ARRAY32 branch (line 573). MAP16 and ARRAY16 use readNextLength16() (max 65,535) and cannot overflow.

References

• msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java, lines 578–579
• CWE-190: https://cwe.mitre.org/data/definitions/190.html
• CWE-20: https://cwe.mitre.org/data/definitions/20.html