Security & Code Quality Audit

[GaltRanch]

Security & Code Quality Audit

Auditor: Astrolexis.space — Kulvex Code
Findings: 31 confirmed (1 false positive filtered)
Scan time: 18s

Summary

A comprehensive security and code-quality audit of the IDF project identified 31 actionable findings across 220 scanned files. The most prevalent vulnerability pattern is unvalidated fixed-index buffer access—accounting for 28 of the 31 findings—where HID, USB, CAN, and Ethernet packet decoders access array elements without prior bounds checks, exposing the system to out-of-bounds reads from attacker-controlled inputs. Additional issues include unsafe pointer arithmetic (reminiscent of the NASA IDF bug), unreachable code, and missing resource cleanup on error paths. All 31 findings have been remediated with minimal, targeted changes that enforce input validation, improve memory safety, and enhance error resilience.

Findings & Fixes

1. [HIGH] Buffer access with fixed index, no size validation — source/idf/BtXBoxOneWireless.cpp:16

Bug: The decode() function unconditionally accesses data[13] without verifying data.size() ≥ 14, and the same pattern recurs 21× in the file. Since data originates from Bluetooth HID packets (Xbox One Wireless), malformed packets can trigger out-of-bounds reads.
Impact: An attacker could craft malicious HID reports with length <14 to leak stack/heap memory contents via data[13], potentially exposing sensitive state or enabling side-channel attacks.
Fix: Added if (data.size() < 14) return; before line 11 (i.e., before the first fixed-index access), ensuring early exit on undersized packets.

2. [HIGH] Buffer access with fixed index, no size validation — source/idf/CanIndustrialProducts.cpp:53

Bug: decode() accesses indices up to data[7] unconditionally, with 13 additional similar accesses in the file. CAN messages are attacker-controlled, so undersized payloads cause out-of-bounds reads.
Impact: Malicious CAN frames with length <8 may leak adjacent memory or cause crashes; in safety-critical industrial contexts, this could affect actuator control logic.
Fix: Inserted if (data.size() < 8) return; at the start of decode() before line 52.

3. [HIGH] Suspicious pointer arithmetic: (&var)[N] — source/idf/EthernetDevice.cpp:160

Bug: (&buffer)[bytesTotal] is used where buffer is const void *; this indexes beyond the pointer variable itself (on the stack), not into the actual buffer contents—a classic NASA IDF–style bug.
Impact: An attacker controlling bytesTotal could read arbitrary stack memory (e.g., return addresses, saved registers), enabling information disclosure or ROP gadget discovery.
Fix: Replaced (&buffer)[bytesTotal] with static_cast<const char*>(buffer) + bytesTotal to correctly advance into the buffer.

4. [MEDIUM] Statement after return/throw/continue (unreachable code) — source/idf/EthernetDevice.cpp:143

Bug: lastPacketArrived = std::time(nullptr); on line 145 is unreachable, appearing immediately after a return in the same block.
Impact: Timestamping of packet arrival is silently skipped, potentially affecting logging, diagnostics, or timeout logic—though not directly exploitable.
Fix: Moved the assignment before the return, ensuring lastPacketArrived is updated on all code paths.

5. [MEDIUM] File descriptor opened without closing on error path — source/idf/EthernetDevice.cpp:30

Bug: socketHandle is created via socket() on line 30, but if socket() fails, the function throws on line 35 without closing the descriptor first.
Impact: Repeated socket failures (e.g., due to resource exhaustion or DoS) cause descriptor leaks, eventually exhausting the process’s file descriptor table and leading to EMFILE errors.
Fix: Added close(socketHandle); before the throw on line 35.

6. [HIGH] Buffer access with fixed index, no size validation — source/idf/EthernetExtreme3dPro.cpp:10

Bug: decode() accesses data[4] and data[6] unconditionally; USB HID packets may be shorter than 7 bytes.
Impact: Undersized HID reports cause out-of-bounds reads, potentially leaking HID descriptor metadata or previous packet state.
**