View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006184GNUnetGNSpublic2020-04-15 11:412020-07-09 07:17
Reporterfefe Assigned ToChristian Grothoff Due Date
PrioritynormalSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product Version0.12.1 
Target Version0.13.0Fixed in Version0.13.0 
Summary0006184: buffer overflow in signal_socks_failure and signal_socks_success
DescriptionI got here by grepping for memset. :-)

The code pattern is this:

3015 s_resp = (struct Socks5ServerResponseMessage *) &s5r->wbuf[s5r->wbuf_len];

And then we just write to s_resp. wbuf_len might already be toward the end of the buffer!

Now the argument could be made that these functions are static and thus can't be called from elsewhere and thus can rely on the caller to do the right thing. Still, this kind of code is called a buffer overflow. Never simply write to a buffer, especially with an offset, unless you verified your write fits in the buffer bounds.
TagsNo tags attached.

Activities

Christian Grothoff

2020-04-15 18:32

manager   ~0015657

Actually, I doubt we ever call this where wbuf_len != 0. But, we should GNUNET_break() on that assumption, and GNUNET_assert() on the buffer size being adequate. Fixed in 7bcd5338f..b7be5b9f5.

schanzen

2020-07-09 07:17

administrator   ~0016427

0.13.0 released

Issue History

Date ModifiedUsernameFieldChange
2020-04-15 11:41fefeNew Issue
2020-04-15 18:32Christian GrothoffNote Added: 0015657
2020-04-15 18:32Christian GrothoffAssigned To => Christian Grothoff
2020-04-15 18:32Christian GrothoffStatusnew => resolved
2020-04-15 18:32Christian GrothoffResolutionopen => fixed
2020-04-15 18:32Christian GrothoffFixed in Version => 0.12.2
2020-04-15 18:32Christian GrothoffTarget Version => 0.12.2
2020-04-23 08:45schanzenFixed in Version0.12.2 => 0.13.0
2020-04-23 08:47schanzenTarget Version0.12.2 => 0.13.0
2020-05-31 22:49AdminknoxIssue cloned: 0006314
2020-05-31 22:52AdminknoxIssue cloned: 0006346
2020-07-09 07:17schanzenNote Added: 0016427
2020-07-09 07:17schanzenStatusresolved => closed