[dlt-sortbytimestamp crash] Unreadable memory reference in my opinion

[zj3t]

Hi COVESA Team!
Contact us to report vulnerabilities.

Summary

I done dlt-sortbytimestamp(+dlt-* binary) source code auditing .
And found that the exception handling was insufficient.
Since I'm not familiar with the dlt structure, I created a simple fuzzer to fuzzing the dlt-sortbytimestamp binary.

And I found a crash, and added ASAN (Address Sanitizer) to get additional information.

Bug Log

In my opinion, when the pointer is moved in the fseek() function, the crash occurs because it is moved to a place that cannot be referenced.
Or, Maybe it's caused by size tampering in the header of the DLT file.
But I don't know the detailed information of the DLT file.

[crash.dlt]

[output.dlt]

Looking at the output file, it was confirmed that it terminated in the middle.

Files

I will attach it.
covesa.zip

It may not be a big deal, it may be a bug (vulnerability), but I am reporting it because I hope you guys will fix it.
Thanks :)

[michael-methner]

Hello @zj3t , thanks for reporting the issue.

I have opened a PR.

[zj3t]

Thanks @michael-methner :)
I'm glad!!
I think the fixes are perfect too.
Could you please tell me the CWE of the vulnerability?

Also can you allow me to get a CVE?

[michael-methner]

Hello @zj3t ,
i am not used to CWE, but I would say it is a: CWE-127: Buffer Under-read

For sure you can get a CVE.

[zj3t]

Thanks @michael-methner :)

[stevebeattie]

FYI, this was assigned CVE-2023-36321.

(I did not assign the CVE, I'm just a messanger who noticed it while triaging recently published CVEs)