Skip to content

Commit

Permalink
Fix marshalls size checks.
Browse files Browse the repository at this point in the history 
Yesterday, when playing around with my network code, I realized there is
a security issue in decode_variant, at least when decoding PoolArrays.
Basically, the size of the PoolArray is encoded in a uint32_t, when
decoding it, that value is cast to int when comparing if the packet is
actually that size causing numbers with MSB=1 to be interpreted as
negative thus always passing the check. That same value though, is used
as uint32_t again to resize the output vector.  For this reason, sending
a malformed packet with declared type PoolByteArray and size of 2^31(+x)
causes the engine to try to allocate 2+GB of pool memory, causing the
engine to crash.

This patch is a backport of the one initially written for the master
branch.
  • Loading branch information
@Faless @akien-mga
Faless authored and akien-mga committed Jul 28, 2018
1 parent 9f0e38c commit 497bc7d
Showing 1 changed file with 99 additions and 112 deletions.
Loading

1 comment on commit 497bc7d

@rcurtis
Copy link
Contributor

@rcurtis rcurtis commented on 497bc7d Aug 8, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm experiencing the following issue:

Any JSON message read by a PacketPeerStream.get_var() fails with the following:

"Condition ' strlen < 0 || strlen + pad > len ' is true. returned: ERR_FILE_EOF"

Has the API changed? It looks like the new error is being generated by this update. Does this deserve a issue ticket?

Please sign in to comment.