Describe the bug
when adding custom probes, some services (e.g. quic) require a fairly large payload which goes over the 2k limit allowed for a probe data. The limit is just a buffer size using during parsing, this should be increased to allow proper parsing, and a check for when that limit is hit should be added to give a more correct error.
To Reproduce
Add a probe to nmap-service-probes with payload over 2k. Example, this probe that gets quic udp servers to respond:
##############################NEXT PROBE##############################
Probe UDP QUIC q|\xcf\x1a\x2b\x3d\x4a\x08\xec\x50\x45\xd8\xed\x5d\x36\x17\x08\xda\xcb\xa9\xb8\xd2\x45\xaf\xde\x00\x44\x96\xa1\xbb\xf8\x24\x98\x77\x1a\x8a\x61\xd8\x7d\x70\x53\xd9\x11\xf5\x82\xf4\x15\x64\x41\xc1\x38\xda\xd8\x5b\x42\xba\xbe\xb9\xe1\xb3\x4b\x5a\xad\x35\xba\x42\xb9\xc7\xe5\x18\x4f\xdd\xcb\x1e\xe6\xa1\x81\x61\x57\xfd\x14\xe4\xe0\x6e\x57\x7d\x96\x73\xa9\x05\x41\x0e\xa8\x53\x1e\x40\xb4\xcc\x07\x9f\xbc\xbd\x20\x1f\x2e\xf6\x02\xcd\xdd\x7c\x0e\x3d\xfb\xfa\x83\xa8\x5b\x18\x6f\xa9\x4d\xdb\x3b\x4c\x5c\x65\xb2\x24\x85\x08\xc0\xb5\x7c\x8e\x90\xd6\x32\x8e\x83\xac\xed\x61\x5d\x40\x55\x3d\xd3\x40\x6a\xe0\x3f\x45\x74\xf8\xf9\x9f\xea\x04\x71\x95\xe7\x8c\xa4\xbe\x80\xb9\x75\x36\xd7\x21\x6f\x3a\xbe\xb3\xdf\x6b\x77\x84\x1e\x93\xcd\x98\xa8\x1d\xde\xc5\x3f\xaf\x44\xa4\x9c\x9c\x57\xad\x79\x69\xc1\x7b\x5f\x1c\xb4\xf2\x80\xf8\xab\x8a\x37\xb2\xde\x93\x18\x96\xa7\x01\x0e\x7b\x2b\xd4\xd9\x9c\x59\x7c\x76\x80\xfd\xf1\x0e\x43\x03\x35\x81\x0d\xdd\x18\x74\x21\x1e\x08\x30\x4f\xf5\xa7\x82\xa6\x84\x12\xfb\x07\xc6\x13\x6d\xed\x53\x14\x69\xce\xc0\x18\xac\x52\x5f\xf0\x0f\x00\xea\x94\x27\xc0\x06\x6d\xc1\xa2\x9e\x28\xd4\x9d\x0b\xbb\xcf\x0b\x21\x1c\x7d\xdf\xfc\xa2\x18\x0f\x3c\x61\x3e\xfd\x12\xb5\xb5\x86\x37\xd6\x44\x3d\x30\x5a\xe1\x6c\xd4\x4c\xf4\x76\xfe\x43\x77\x90\xbd\x91\xb3\x6b\x36\xb4\x6f\x00\x19\x37\x2a\xfc\xc6\x8a\xb1\xd4\xea\xd3\xf6\x13\x63\xff\x22\x8a\x6f\x0e\x8a\x57\xe7\x18\xe2\x4b\xa6\xec\xe1\xa5\xe0\x29\x40\x5e\xf7\x7b\x38\x34\xad\x1e\x6a\x3e\x6d\xff\x01\xa3\x41\x6e\x11\x40\x25\xc2\xeb\x27\x41\x2d\x93\x63\x2f\x89\x42\xcd\x07\x71\xa6\xa8\xb9\x73\xfd\xfb\x61\x69\xd9\x5b\xc9\xe1\xc0\x76\x2b\x91\x33\x73\x69\x1d\x68\x61\x5b\x39\x21\x7f\x7f\x02\xe8\x27\xf5\x0a\x7a\x79\x77\x44\x6d\xec\x74\x01\x1b\x16\x1b\x11\xde\xbc\x25\x06\x70\x6e\x95\xaa\xdd\x46\x08\x5f\xeb\x19\x45\x2f\xfc\x46\xe6\xd2\x20\x7f\xff\xe1\x8c\x34\x3d\xd2\x5d\x7f\x09\xec\xb9\x95\x2a\xb2\x2d\x58\x15\x4a\xbf\x72\x7d\x0f\x65\x79\x28\x07\x36\xef\xe9\xa1\x48\x70\x8e\x13\xc0\x97\x5d\x4a\x17\x8a\xa5\x3a\x75\xbe\x59\xe3\x5e\xf7\xc5\xa2\x59\xf1\xe1\x8b\x89\xb2\x30\x97\xaf\x15\x0d\x91\x57\x68\x2f\x0b\xa7\x21\xa0\xaf\x20\xa4\x07\x5b\x05\x2f\x70\xba\xb5\xbb\xc1\xc1\xef\xd5\xb3\x7b\xb3\xdb\x56\x97\xfe\xd0\x07\xd2\x79\x44\xec\xbd\x8d\xd1\x29\xb0\xdb\xdf\x0c\xdd\x4e\xa5\xe2\x99\x79\xe5\x31\x55\x76\x45\x37\x0c\x30\x6a\xdf\x25\xa2\x6f\xbc\x65\x57\xf5\xe0\x9f\xbe\x16\x6e\x80\x79\xe8\xc2\x90\x2a\xf2\x42\xf6\x4d\x5b\xc5\xfb\xa7\x78\xf8\xd3\xe1\xc0\x66\x1b\xb5\x14\x17\x11\x9c\x2e\xb2\xc8\x82\x52\x0a\xd6\xa4\xf8\xca\xac\x2c\xfe\x31\x94\x8f\x43\x8a\x28\x3e\xfc\x42\xee\xb5\x06\xbd\x60\x0c\xf2\x2d\x2f\x43\xe8\x63\x88\x12\xf3\xb0\xb8\x79\x9d\xd3\x66\x5a\x21\x96\x56\xd0\x60\x6f\xea\x97\xa2\x32\x81\xfe\x02\x54\x21\x2b\x32\xcd\xdd\x53\xba\x90\xe3\x80\xb0\x48\x19\xd0\x72\x0e\x33\x61\xd5\x06\xfc\x98\x84\xa5\x72\x8d\xdd\x21\x1e\xc8\xe6\xb0\xdb\x62\x92\xe5\x96\x94\x32\x4a\x5c\xef\x14\x31\xa1\xb2\x96\x57\x13\x95\xab\x6b\x3b\xe5\x58\xc6\x00\xa4\x8f\x23\xd9\x31\xcc\x70\x09\x12\xe6\x98\xdc\xb1\x69\x39\x4f\xe8\xe4\xe8\x76\xd6\xd6\x97\xf3\xfc\x5e\x85\x20\x1d\x55\x71\xbd\x34\xb5\x89\x3e\x9e\x2d\xa2\xb8\xe6\x3f\x2e\x61\xcd\xf5\xe2\x16\x0e\x02\x2a\x5a\xdd\x44\x7a\xa7\xa8\xa7\x2e\xf9\x6a\xc6\xc4\x40\x80\x74\x02\x07\x7b\xa6\x15\x1d\xcc\xa9\x42\x34\xd4\xe1\xab\x7b\xd7\x5a\xb3\x2e\xfa\x33\xc3\x15\xdc\xc8\xdc\x7c\x8d\x38\x26\xad\x28\x46\xb3\x92\xd5\x89\x06\x76\x87\xd6\x8f\x5f\x05\xaa\xfa\x8e\xe7\x5d\x97\x88\xf9\x69\xd9\x10\x89\x52\xc2\xb4\x39\xd7\xa3\xe2\xaf\x5a\x25\xf7\xe7\xef\xd9\x1e\x7b\x40\x00\x78\xa3\x5e\xd9\x38\x31\xf9\x70\xc5\xf6\x86\x31\x57\xe8\x48\x21\x3f\xf1\x39\xfe\x44\xdb\xba\xf8\x3f\xd2\xc0\x6e\x43\x1a\x00\x10\x19\x7e\x53\x81\xec\x4d\x84\x7b\x13\x61\x81\xd9\xae\x07\x71\x81\xf5\xad\xf6\xc3\xa7\x68\x9e\x17\xc4\x62\x4b\x21\x46\x37\xf1\x38\xec\xac\x11\xee\x64\x13\x12\x32\x84\x7f\x5f\x30\x19\xb5\x36\x5f\xe5\x2b\x45\xb4\x0f\x7a\xe2\xd0\xff\xf3\x6f\x59\xe2\x8d\xbd\x9a\x80\x48\x59\x22\x95\x2b\x7f\xb7\x1a\x0b\xe8\xfd\x92\xbc\x03\x51\x45\x09\xeb\xe9\x83\x73\xf3\xf5\xc6\xeb\x80\x04\x89\x08\x23\x88\xaa\x5e\x99\xe5\xea\x4a\x75\xfd\x90\x2e\xb4\xd6\x80\x00\x8c\x8c\x59\x3f\xc8\x1c\x8f\x0d\x18\xba\x17\x7b\x0a\x73\x48\x66\xe1\x7b\xad\xa3\x4a\x86\x43\xcc\xc8\x22\x06\x6a\xa1\x9e\x47\x2a\x88\x09\x38\x4d\x4f\x3d\x86\x8f\xbf\x98\x70\xc0\xe5\xab\x9c\x8f\x2e\x72\x60\x59\xbb\xb3\x38\x22\x9e\xe0\x99\x6a\x03\x64\xc0\x5f\xdb\xfb\x98\xb9\xc9\xb1\xb0\x2a\x27\xf9\x4d\xfd\x08\x4f\x65\xe8\x20\x34\xfe\x5d\xb8\x7f\xc6\x2b\xff\x65\x43\xd2\x57\xe3\xed\x18\xfb\xfb\x88\xa6\x47\xcf\x31\x3c\x7a\x35\x83\xb7\xfa\xde\xfb\xa7\x38\xd1\xc7\xe7\x02\xcd\x94\xc7\x57\x79\x77\xea\xad\x5b\x65\x74\x13\x9c\x5d\xb4\x0b\x01\x6a\x76\x5c\xe8\xcf\xe9\x17\x92\x9f\xfb\xc7\x52\x38\x97\x4b\xd5\x7e\x87\x24\x59\xf1\x6d\x39\xac\x4e\x81\x7e\x1b\xd1\x22\x78\xc0\x71\x09\x42\xc5\x10\x80\x4d\x8c\xbc\x07\x4a\xb3\x75\x88\x2c\x74\x30\x5d\x18\xa6\x6b\xf9\x2c\x1d\xd1\xe2\x45\xd5\xb1\x4d\xe1\xe7\x12\xcf\x1a\x2b\x3d\x4a\x08\xec\x50\x45\xd8\xed\x5d\x36\x17\x08\xda\xcb\xa9\xb8\xd2\x45\xaf\xde\x00\x44\x96\xa1\xbb\xf8\x24\x98\x77\x1a\x8a\x61\xd8\x7d\x70\x53\xd9\x11\xf5\x82\xf4\x15\x64\x41\xc1\x38\xda\xd8\x5b\x42\xba\xbe\xb9\xe1\xb3\x4b\x5a\xad\x35\xba\x42\xb9\xc7\xe5\x18\x4f\xdd\xcb\x1e\xe6\xa1\x81\x61\x57\xfd\x14\xe4\xe0\x6e\x57\x7d\x96\x73\xa9\x05\x41\x0e\xa8\x53\x1e\x40\xb4\xcc\x07\x9f\xbc\xbd\x20\x1f\x2e\xf6\x02\xcd\xdd\x7c\x0e\x3d\xfb\xfa\x83\xa8\x5b\x18\x6f\xa9\x4d\xdb\x3b\x4c\x5c\x65\xb2\x24\x85\x08\xc0\xb5\x7c\x8e\x90\xd6\x32\x8e\x83\xac\xed\x61\x5d\x40\x55\x3d\xd3\x40\x6a\xe0\x3f\x45\x74\xf8\xf9\x9f\xea\x04\x71\x95\xe7\x8c\xa4\xbe\x80\xb9\x75\x36\xd7\x21\x6f\x3a\xbe\xb3\xdf\x6b\x77\x84\x1e\x93\xcd\x98\xa8\x1d\xde\xc5\x3f\xaf\x44\xa4\x9c\x9c\x57\xad\x79\x69\xc1\x7b\x5f\x1c\xb4\xf2\x80\xf8\xab\x8a\x37\xb2\xde\x93\x18\x96\xa7\x01\x0e\x7b\x2b\xd4\xd9\x9c\x59\x7c\x76\x80\xfd\xf1\x0e\x43\x03\x35\x81\x0d\xdd\x18\x74\x21\x1e\x08\x30\x4f\xf5\xa7\x82\xa6\x84\x12\xfb\x07\xc6\x13\x6d\xed\x53\x14\x69\xce\xc0\x18\xac\x52\x5f\xf0\x0f\x00\xea\x94\x27\xc0\x06\x6d\xc1\xa2\x9e\x28\xd4\x9d\x0b\xbb\xcf\x0b\x21\x1c\x7d\xdf\xfc\xa2\x18\x0f\x3c\x61\x3e\xfd\x12\xb5\xb5\x86\x37\xd6\x44\x3d\x30\x5a\xe1\x6c\xd4\x4c\xf4\x76\xfe\x43\x77\x90\xbd\x91\xb3\x6b\x36\xb4\x6f\x00\x19\x37\x2a\xfc\xc6\x8a\xb1\xd4\xea\xd3\xf6\x13\x63\xff\x22\x8a\x6f\x0e\x8a\x57\xe7\x18\xe2\x4b\xa6\xec\xe1\xa5\xe0\x29\x40\x5e\xf7\x7b\x38\x34\xad\x1e\x6a\x3e\x6d\xff\x01\xa3\x41\x6e\x11\x40\x25\xc2\xeb\x27\x41\x2d\x93\x63\x2f\x89\x42\xcd\x07\x71\xa6\xa8\xb9\x73\xfd\xfb\x61\x69\xd9\x5b\xc9\xe1\xc0\x76\x2b\x91\x33\x73\x69\x1d\x68\x61\x5b\x39\x21\x7f\x7f\x02\xe8\x27\xf5\x0a\x7a\x79\x77\x44\x6d\xec\x74\x01\x1b\x16\x1b\x11\xde\xbc\x25\x06\x70\x6e\x95\xaa\xdd\x46\x08\x5f\xeb\x19\x45\x2f\xfc\x46\xe6\xd2\x20\x7f\xff\xe1\x8c\x34\x3d\xd2\x5d\x7f\x09\xec\xb9\x95\x2a\xb2\x2d\x58\x15\x4a\xbf\x72\x7d\x0f\x65\x79\x28\x07\x36\xef\xe9\xa1\x48\x70\x8e\x13\xc0\x97\x5d\x4a\x17\x8a\xa5\x3a\x75\xbe\x59\xe3\x5e|
rarity 1
ports 80,443,8080,8443
match quic m|^.\0\0\0\0\x08\xda\xcb\xa9\xb8\xd2E\xaf\xde\x08\xecPE\xd8\xed\]6\x17|
Additional context
patch to fix:
diff --git a/service_scan.cc b/service_scan.cc
index cf13d8b..3ff276f 100644
--- a/service_scan.cc
+++ b/service_scan.cc
@@ -1288,7 +1288,7 @@ void ServiceProbe::addMatch(const char *match, int lineno) {
(servicematch) which use this */
void parse_nmap_service_probe_file(AllProbes *AP, const char *filename) {
ServiceProbe *newProbe = NULL;
- char line[2048];
+ char line[16384];
int lineno = 0;
FILE *fp;
@@ -1316,6 +1316,10 @@ void parse_nmap_service_probe_file(AllProbes *AP, const char *filename) {
if (strncmp(line, "Probe ", 6) != 0)
fatal("Parse error on line %d of nmap-service-probes file: %s -- line was expected to begin with \"Probe \" or \"Exclude \"", lineno, filename);
+ if (strnlen(line, sizeof(line)) >= sizeof(line) - 1) {
+ fatal("Parse error on line %d of nmap-service-probes file: %s -- line is too long for buffer, max length is %lu", lineno, filename, sizeof(line));
+ }
+
newProbe = new ServiceProbe();
newProbe->setProbeDetails(line + 6, lineno);
originally I created #2803 but I reset my clone which apparently auto-closed the PR so making this bug report instead for tracking purposes.
Describe the bug
when adding custom probes, some services (e.g. quic) require a fairly large payload which goes over the 2k limit allowed for a probe data. The limit is just a buffer size using during parsing, this should be increased to allow proper parsing, and a check for when that limit is hit should be added to give a more correct error.
To Reproduce
Add a probe to nmap-service-probes with payload over 2k. Example, this probe that gets quic udp servers to respond:
Additional context
patch to fix:
originally I created #2803 but I reset my clone which apparently auto-closed the PR so making this bug report instead for tracking purposes.