Skip to content

Service/version detection: Added nmap probes can't be over 2k, and gives incorrect parsing error if they are #3201

Description

@liquidpele

Describe the bug
when adding custom probes, some services (e.g. quic) require a fairly large payload which goes over the 2k limit allowed for a probe data. The limit is just a buffer size using during parsing, this should be increased to allow proper parsing, and a check for when that limit is hit should be added to give a more correct error.

To Reproduce
Add a probe to nmap-service-probes with payload over 2k. Example, this probe that gets quic udp servers to respond:

##############################NEXT PROBE##############################
Probe UDP QUIC q|\xcf\x1a\x2b\x3d\x4a\x08\xec\x50\x45\xd8\xed\x5d\x36\x17\x08\xda\xcb\xa9\xb8\xd2\x45\xaf\xde\x00\x44\x96\xa1\xbb\xf8\x24\x98\x77\x1a\x8a\x61\xd8\x7d\x70\x53\xd9\x11\xf5\x82\xf4\x15\x64\x41\xc1\x38\xda\xd8\x5b\x42\xba\xbe\xb9\xe1\xb3\x4b\x5a\xad\x35\xba\x42\xb9\xc7\xe5\x18\x4f\xdd\xcb\x1e\xe6\xa1\x81\x61\x57\xfd\x14\xe4\xe0\x6e\x57\x7d\x96\x73\xa9\x05\x41\x0e\xa8\x53\x1e\x40\xb4\xcc\x07\x9f\xbc\xbd\x20\x1f\x2e\xf6\x02\xcd\xdd\x7c\x0e\x3d\xfb\xfa\x83\xa8\x5b\x18\x6f\xa9\x4d\xdb\x3b\x4c\x5c\x65\xb2\x24\x85\x08\xc0\xb5\x7c\x8e\x90\xd6\x32\x8e\x83\xac\xed\x61\x5d\x40\x55\x3d\xd3\x40\x6a\xe0\x3f\x45\x74\xf8\xf9\x9f\xea\x04\x71\x95\xe7\x8c\xa4\xbe\x80\xb9\x75\x36\xd7\x21\x6f\x3a\xbe\xb3\xdf\x6b\x77\x84\x1e\x93\xcd\x98\xa8\x1d\xde\xc5\x3f\xaf\x44\xa4\x9c\x9c\x57\xad\x79\x69\xc1\x7b\x5f\x1c\xb4\xf2\x80\xf8\xab\x8a\x37\xb2\xde\x93\x18\x96\xa7\x01\x0e\x7b\x2b\xd4\xd9\x9c\x59\x7c\x76\x80\xfd\xf1\x0e\x43\x03\x35\x81\x0d\xdd\x18\x74\x21\x1e\x08\x30\x4f\xf5\xa7\x82\xa6\x84\x12\xfb\x07\xc6\x13\x6d\xed\x53\x14\x69\xce\xc0\x18\xac\x52\x5f\xf0\x0f\x00\xea\x94\x27\xc0\x06\x6d\xc1\xa2\x9e\x28\xd4\x9d\x0b\xbb\xcf\x0b\x21\x1c\x7d\xdf\xfc\xa2\x18\x0f\x3c\x61\x3e\xfd\x12\xb5\xb5\x86\x37\xd6\x44\x3d\x30\x5a\xe1\x6c\xd4\x4c\xf4\x76\xfe\x43\x77\x90\xbd\x91\xb3\x6b\x36\xb4\x6f\x00\x19\x37\x2a\xfc\xc6\x8a\xb1\xd4\xea\xd3\xf6\x13\x63\xff\x22\x8a\x6f\x0e\x8a\x57\xe7\x18\xe2\x4b\xa6\xec\xe1\xa5\xe0\x29\x40\x5e\xf7\x7b\x38\x34\xad\x1e\x6a\x3e\x6d\xff\x01\xa3\x41\x6e\x11\x40\x25\xc2\xeb\x27\x41\x2d\x93\x63\x2f\x89\x42\xcd\x07\x71\xa6\xa8\xb9\x73\xfd\xfb\x61\x69\xd9\x5b\xc9\xe1\xc0\x76\x2b\x91\x33\x73\x69\x1d\x68\x61\x5b\x39\x21\x7f\x7f\x02\xe8\x27\xf5\x0a\x7a\x79\x77\x44\x6d\xec\x74\x01\x1b\x16\x1b\x11\xde\xbc\x25\x06\x70\x6e\x95\xaa\xdd\x46\x08\x5f\xeb\x19\x45\x2f\xfc\x46\xe6\xd2\x20\x7f\xff\xe1\x8c\x34\x3d\xd2\x5d\x7f\x09\xec\xb9\x95\x2a\xb2\x2d\x58\x15\x4a\xbf\x72\x7d\x0f\x65\x79\x28\x07\x36\xef\xe9\xa1\x48\x70\x8e\x13\xc0\x97\x5d\x4a\x17\x8a\xa5\x3a\x75\xbe\x59\xe3\x5e\xf7\xc5\xa2\x59\xf1\xe1\x8b\x89\xb2\x30\x97\xaf\x15\x0d\x91\x57\x68\x2f\x0b\xa7\x21\xa0\xaf\x20\xa4\x07\x5b\x05\x2f\x70\xba\xb5\xbb\xc1\xc1\xef\xd5\xb3\x7b\xb3\xdb\x56\x97\xfe\xd0\x07\xd2\x79\x44\xec\xbd\x8d\xd1\x29\xb0\xdb\xdf\x0c\xdd\x4e\xa5\xe2\x99\x79\xe5\x31\x55\x76\x45\x37\x0c\x30\x6a\xdf\x25\xa2\x6f\xbc\x65\x57\xf5\xe0\x9f\xbe\x16\x6e\x80\x79\xe8\xc2\x90\x2a\xf2\x42\xf6\x4d\x5b\xc5\xfb\xa7\x78\xf8\xd3\xe1\xc0\x66\x1b\xb5\x14\x17\x11\x9c\x2e\xb2\xc8\x82\x52\x0a\xd6\xa4\xf8\xca\xac\x2c\xfe\x31\x94\x8f\x43\x8a\x28\x3e\xfc\x42\xee\xb5\x06\xbd\x60\x0c\xf2\x2d\x2f\x43\xe8\x63\x88\x12\xf3\xb0\xb8\x79\x9d\xd3\x66\x5a\x21\x96\x56\xd0\x60\x6f\xea\x97\xa2\x32\x81\xfe\x02\x54\x21\x2b\x32\xcd\xdd\x53\xba\x90\xe3\x80\xb0\x48\x19\xd0\x72\x0e\x33\x61\xd5\x06\xfc\x98\x84\xa5\x72\x8d\xdd\x21\x1e\xc8\xe6\xb0\xdb\x62\x92\xe5\x96\x94\x32\x4a\x5c\xef\x14\x31\xa1\xb2\x96\x57\x13\x95\xab\x6b\x3b\xe5\x58\xc6\x00\xa4\x8f\x23\xd9\x31\xcc\x70\x09\x12\xe6\x98\xdc\xb1\x69\x39\x4f\xe8\xe4\xe8\x76\xd6\xd6\x97\xf3\xfc\x5e\x85\x20\x1d\x55\x71\xbd\x34\xb5\x89\x3e\x9e\x2d\xa2\xb8\xe6\x3f\x2e\x61\xcd\xf5\xe2\x16\x0e\x02\x2a\x5a\xdd\x44\x7a\xa7\xa8\xa7\x2e\xf9\x6a\xc6\xc4\x40\x80\x74\x02\x07\x7b\xa6\x15\x1d\xcc\xa9\x42\x34\xd4\xe1\xab\x7b\xd7\x5a\xb3\x2e\xfa\x33\xc3\x15\xdc\xc8\xdc\x7c\x8d\x38\x26\xad\x28\x46\xb3\x92\xd5\x89\x06\x76\x87\xd6\x8f\x5f\x05\xaa\xfa\x8e\xe7\x5d\x97\x88\xf9\x69\xd9\x10\x89\x52\xc2\xb4\x39\xd7\xa3\xe2\xaf\x5a\x25\xf7\xe7\xef\xd9\x1e\x7b\x40\x00\x78\xa3\x5e\xd9\x38\x31\xf9\x70\xc5\xf6\x86\x31\x57\xe8\x48\x21\x3f\xf1\x39\xfe\x44\xdb\xba\xf8\x3f\xd2\xc0\x6e\x43\x1a\x00\x10\x19\x7e\x53\x81\xec\x4d\x84\x7b\x13\x61\x81\xd9\xae\x07\x71\x81\xf5\xad\xf6\xc3\xa7\x68\x9e\x17\xc4\x62\x4b\x21\x46\x37\xf1\x38\xec\xac\x11\xee\x64\x13\x12\x32\x84\x7f\x5f\x30\x19\xb5\x36\x5f\xe5\x2b\x45\xb4\x0f\x7a\xe2\xd0\xff\xf3\x6f\x59\xe2\x8d\xbd\x9a\x80\x48\x59\x22\x95\x2b\x7f\xb7\x1a\x0b\xe8\xfd\x92\xbc\x03\x51\x45\x09\xeb\xe9\x83\x73\xf3\xf5\xc6\xeb\x80\x04\x89\x08\x23\x88\xaa\x5e\x99\xe5\xea\x4a\x75\xfd\x90\x2e\xb4\xd6\x80\x00\x8c\x8c\x59\x3f\xc8\x1c\x8f\x0d\x18\xba\x17\x7b\x0a\x73\x48\x66\xe1\x7b\xad\xa3\x4a\x86\x43\xcc\xc8\x22\x06\x6a\xa1\x9e\x47\x2a\x88\x09\x38\x4d\x4f\x3d\x86\x8f\xbf\x98\x70\xc0\xe5\xab\x9c\x8f\x2e\x72\x60\x59\xbb\xb3\x38\x22\x9e\xe0\x99\x6a\x03\x64\xc0\x5f\xdb\xfb\x98\xb9\xc9\xb1\xb0\x2a\x27\xf9\x4d\xfd\x08\x4f\x65\xe8\x20\x34\xfe\x5d\xb8\x7f\xc6\x2b\xff\x65\x43\xd2\x57\xe3\xed\x18\xfb\xfb\x88\xa6\x47\xcf\x31\x3c\x7a\x35\x83\xb7\xfa\xde\xfb\xa7\x38\xd1\xc7\xe7\x02\xcd\x94\xc7\x57\x79\x77\xea\xad\x5b\x65\x74\x13\x9c\x5d\xb4\x0b\x01\x6a\x76\x5c\xe8\xcf\xe9\x17\x92\x9f\xfb\xc7\x52\x38\x97\x4b\xd5\x7e\x87\x24\x59\xf1\x6d\x39\xac\x4e\x81\x7e\x1b\xd1\x22\x78\xc0\x71\x09\x42\xc5\x10\x80\x4d\x8c\xbc\x07\x4a\xb3\x75\x88\x2c\x74\x30\x5d\x18\xa6\x6b\xf9\x2c\x1d\xd1\xe2\x45\xd5\xb1\x4d\xe1\xe7\x12\xcf\x1a\x2b\x3d\x4a\x08\xec\x50\x45\xd8\xed\x5d\x36\x17\x08\xda\xcb\xa9\xb8\xd2\x45\xaf\xde\x00\x44\x96\xa1\xbb\xf8\x24\x98\x77\x1a\x8a\x61\xd8\x7d\x70\x53\xd9\x11\xf5\x82\xf4\x15\x64\x41\xc1\x38\xda\xd8\x5b\x42\xba\xbe\xb9\xe1\xb3\x4b\x5a\xad\x35\xba\x42\xb9\xc7\xe5\x18\x4f\xdd\xcb\x1e\xe6\xa1\x81\x61\x57\xfd\x14\xe4\xe0\x6e\x57\x7d\x96\x73\xa9\x05\x41\x0e\xa8\x53\x1e\x40\xb4\xcc\x07\x9f\xbc\xbd\x20\x1f\x2e\xf6\x02\xcd\xdd\x7c\x0e\x3d\xfb\xfa\x83\xa8\x5b\x18\x6f\xa9\x4d\xdb\x3b\x4c\x5c\x65\xb2\x24\x85\x08\xc0\xb5\x7c\x8e\x90\xd6\x32\x8e\x83\xac\xed\x61\x5d\x40\x55\x3d\xd3\x40\x6a\xe0\x3f\x45\x74\xf8\xf9\x9f\xea\x04\x71\x95\xe7\x8c\xa4\xbe\x80\xb9\x75\x36\xd7\x21\x6f\x3a\xbe\xb3\xdf\x6b\x77\x84\x1e\x93\xcd\x98\xa8\x1d\xde\xc5\x3f\xaf\x44\xa4\x9c\x9c\x57\xad\x79\x69\xc1\x7b\x5f\x1c\xb4\xf2\x80\xf8\xab\x8a\x37\xb2\xde\x93\x18\x96\xa7\x01\x0e\x7b\x2b\xd4\xd9\x9c\x59\x7c\x76\x80\xfd\xf1\x0e\x43\x03\x35\x81\x0d\xdd\x18\x74\x21\x1e\x08\x30\x4f\xf5\xa7\x82\xa6\x84\x12\xfb\x07\xc6\x13\x6d\xed\x53\x14\x69\xce\xc0\x18\xac\x52\x5f\xf0\x0f\x00\xea\x94\x27\xc0\x06\x6d\xc1\xa2\x9e\x28\xd4\x9d\x0b\xbb\xcf\x0b\x21\x1c\x7d\xdf\xfc\xa2\x18\x0f\x3c\x61\x3e\xfd\x12\xb5\xb5\x86\x37\xd6\x44\x3d\x30\x5a\xe1\x6c\xd4\x4c\xf4\x76\xfe\x43\x77\x90\xbd\x91\xb3\x6b\x36\xb4\x6f\x00\x19\x37\x2a\xfc\xc6\x8a\xb1\xd4\xea\xd3\xf6\x13\x63\xff\x22\x8a\x6f\x0e\x8a\x57\xe7\x18\xe2\x4b\xa6\xec\xe1\xa5\xe0\x29\x40\x5e\xf7\x7b\x38\x34\xad\x1e\x6a\x3e\x6d\xff\x01\xa3\x41\x6e\x11\x40\x25\xc2\xeb\x27\x41\x2d\x93\x63\x2f\x89\x42\xcd\x07\x71\xa6\xa8\xb9\x73\xfd\xfb\x61\x69\xd9\x5b\xc9\xe1\xc0\x76\x2b\x91\x33\x73\x69\x1d\x68\x61\x5b\x39\x21\x7f\x7f\x02\xe8\x27\xf5\x0a\x7a\x79\x77\x44\x6d\xec\x74\x01\x1b\x16\x1b\x11\xde\xbc\x25\x06\x70\x6e\x95\xaa\xdd\x46\x08\x5f\xeb\x19\x45\x2f\xfc\x46\xe6\xd2\x20\x7f\xff\xe1\x8c\x34\x3d\xd2\x5d\x7f\x09\xec\xb9\x95\x2a\xb2\x2d\x58\x15\x4a\xbf\x72\x7d\x0f\x65\x79\x28\x07\x36\xef\xe9\xa1\x48\x70\x8e\x13\xc0\x97\x5d\x4a\x17\x8a\xa5\x3a\x75\xbe\x59\xe3\x5e|
rarity 1
ports 80,443,8080,8443

match quic m|^.\0\0\0\0\x08\xda\xcb\xa9\xb8\xd2E\xaf\xde\x08\xecPE\xd8\xed\]6\x17|

Additional context

patch to fix:

diff --git a/service_scan.cc b/service_scan.cc
index cf13d8b..3ff276f 100644
--- a/service_scan.cc
+++ b/service_scan.cc
@@ -1288,7 +1288,7 @@ void ServiceProbe::addMatch(const char *match, int lineno) {
    (servicematch) which use this */
 void parse_nmap_service_probe_file(AllProbes *AP, const char *filename) {
   ServiceProbe *newProbe = NULL;
-  char line[2048];
+  char line[16384];
   int lineno = 0;
   FILE *fp;
 
@@ -1316,6 +1316,10 @@ void parse_nmap_service_probe_file(AllProbes *AP, const char *filename) {
     if (strncmp(line, "Probe ", 6) != 0)
       fatal("Parse error on line %d of nmap-service-probes file: %s -- line was expected to begin with \"Probe \" or \"Exclude \"", lineno, filename);
 
+    if (strnlen(line, sizeof(line)) >= sizeof(line) - 1) {
+      fatal("Parse error on line %d of nmap-service-probes file: %s -- line is too long for buffer, max length is %lu", lineno, filename, sizeof(line));
+    }
+
     newProbe = new ServiceProbe();
     newProbe->setProbeDetails(line + 6, lineno);

originally I created #2803 but I reset my clone which apparently auto-closed the PR so making this bug report instead for tracking purposes.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions