GHSA-797x-p4mc-jwpm MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

• Maven org.mariadb.jdbc:mariadb-java-client: >= 3.0.0, < 3.3.7 → fixed in 3.3.7 • Maven org.mariadb.jdbc:mariadb-java-client: >= 3.4.0, < 3.4.5 → fixed in 3.4.5 • Maven org.mariadb.jdbc:mariadb-java-client: >= 3.5.0, < 3.5.10 → fixed in 3.5.10

Summary MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to `int` without validation. A rogue or MitM server can send a value above `Integer.MAX_VALUE` whose truncation becomes a negative or arbitrary length. Details The protocol encodes lengths as length-encoded integers, whose 8-byte form the decoder (`readLength()` and `readIntLengthEncodedNotNull()`) returned as `(int) readLong()`. A value above `Integer.MAX_VALUE` therefore wrapped to a negative or unrelated `int`, used afterwards as a length to size allocations or reads, which ended in `NegativeArraySizeException`, out-of-bounds exceptions or oversized allocations. The fix rejects any length-encoded value that does not fit a non-negative `int` with an explicit error. Impact Availability only: a malicious or compromised server, or a MitM, can crash the client's connection handling with unchecked exceptions or drive oversized allocations. Exploitation requires control of the server side of the connection; no authentication bypass, confidentiality or integrity impact. Credit Reported by fg0x0