Global Buffer Overflow in Commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 #23
Comments
Root CauseThe msg buffer, defined as a global variable with a fixed size (MAXPACKETSIZE), is being overrun. The Python client sends a buffer (buf) of 50,000 bytes, which exceeds MAXPACKETSIZE. When attempting to null-terminate the received message (msg[n]=0), the code writes beyond the allocated buffer if n is equal to MAXPACKETSIZE, leading to a buffer overflow. Specific LocationThe overflow occurs at TCPServer::Task(void*) ../src/TCPServer.cpp:39, where the received message attempts to be null-terminated without ensuring that n (the number of bytes received) is within the bounds of the msg array. SimpleNetwork/src/TCPServer.cpp Line 39 in 29bc615 Address Sanitizer OutputMitigationTo resolve this issue, ensure that the received message does not exceed the msg buffer size. This involves checking the size of the data received and handling cases where it exceeds MAXPACKETSIZE.
Below is a mitigation that can be applied to the code to prevent the global buffer overflow: void* TCPServer::Task(void *arg) {
int n;
struct descript_socket *desc = (struct descript_socket*) arg;
pthread_detach(pthread_self());
cerr << "open client[ id:"<< desc->id <<" ip:"<< desc->ip <<" socket:"<< desc->socket<<" send:"<< desc->enable_message_runtime <<" ]" << endl;
while(1) {
// Ensure we do not exceed the buffer size, leaving space for a null terminator
n = recv(desc->socket, msg, MAXPACKETSIZE - 1, 0);
if(n != -1) {
if(n == 0) {
// Handle client disconnection...
}
else {
// Ensure the message is null-terminated
msg[n] = 0;
desc->message = string(msg);
std::lock_guard<std::mutex> guard(mt);
Message.push_back(desc);
}
}
usleep(600);
}
// Cleanup and exit the thread...
}
|
Hi!
I was running my fuzzer in the background again when I discovered a global buffer overflow bug in the SimpleNetwork TCPServer.
Compiling the project
Global Buffer Overflow
Server commit 29bc615 suffers from a global buffer overflow when the TCPServer receives a single large packet containing ASCII characters. Using the following python3 script will invoke a global buffer overflow:
Compiling the project with address sanitizer helps confirm this issue. Here is the makefile for the example TCPServer:
Address Sanitizer Output:
The text was updated successfully, but these errors were encountered: