View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006154GNUnetARM servicepublic2020-04-03 10:222020-08-14 10:04
Reporterfefe Assigned ToChristian Grothoff Due Date
PrioritynormalSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product VersionGit master 
Target Version0.13.0 
Summary0006154: Integer overflow in GNUNET_STRINGS_buffer_fill
Description  64 size_t
  65 GNUNET_STRINGS_buffer_fill (char *buffer, size_t size, unsigned int count, ...)
  66 {
  67 size_t needed;
  68 size_t slen;
  69 const char *s;
  70 va_list ap;
  71
  72 needed = 0;
  73 va_start (ap, count);
  74 while (count > 0)
  75 {
  76 s = va_arg (ap, const char *);
  77
  78 slen = strlen (s) + 1;
  79 if (buffer != NULL)
  80 {
  81 GNUNET_assert (needed + slen <= size);

The arithmetic can overflow here. That could only happen if the caller is trying to trick you, so it's a defense in depth thing. But maybe the caller was attacked and the attacker gained enough control to trick this function and not to gain code execution immediately. In that case, this bug would give him code execution.
Steps To ReproduceRecommendation:

  GNUNET_assert(slen <= size - needed);
TagsNo tags attached.

Activities

Christian Grothoff

2020-04-03 12:24

manager   ~0015500

Fixed in a3d4063b7..1b5dfc396 (together with a related issue: check only applied if buffer is non-NULL). Plus scope minizations.

schanzen

2020-08-14 10:04

administrator   ~0016621

Closing as resolved since at least 0.13.2

Issue History

Date ModifiedUsernameFieldChange
2020-04-03 10:22fefeNew Issue
2020-04-03 10:22fefeStatusnew => assigned
2020-04-03 10:22fefeAssigned To => Christian Grothoff
2020-04-03 12:24Christian GrothoffNote Added: 0015500
2020-04-03 12:24Christian GrothoffProjectTaler => GNUnet
2020-04-03 12:24Christian GrothoffCategoryexchange => General
2020-04-03 12:25Christian GrothoffStatusassigned => resolved
2020-04-03 12:25Christian GrothoffResolutionopen => fixed
2020-04-03 12:25Christian GrothoffFixed in Version => 0.12.3
2020-04-03 12:25Christian GrothoffCategoryGeneral => ARM service
2020-04-03 12:25Christian GrothoffProduct Version0.7.0 => Git master
2020-04-03 12:25Christian GrothoffTarget Version => 0.12.3
2020-04-22 15:27schanzenTarget Version0.12.3 => 0.13.0
2020-05-31 22:52AdminknoxIssue cloned: 0006356
2020-08-14 10:04schanzenNote Added: 0016621
2020-08-14 10:04schanzenStatusresolved => closed