COVESA / COVESA/dlt-daemon

NULL byte overflow in dlt_message_argument_print

Open
#616 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
459
Forks
340
Avg merge
4d 21h
Merged PRs (30d)
2

Description

## Summary
A buffer overflow vulnerability exists in the DLT_MSG_READ_STRING function called by the dlt_message_argument_print function.
NULL byte overflow occurs when copying a string of DLT_CONVERT_TEXTBUFSIZE (10024) length.

## Details
1. Execute dlt-convert with the -a argument, using a DLT file containing a string of length DLT_CONVERT_TEXTBUFSIZE
2. The functions are called in the following sequence:
`dlt_message_payload` -> `dlt_message_argument_print` -> `DLT_MSG_READ_STRING`
3. After the execution of memcpy and dlt_clean_string functions, the statement dst[length] = 0 is executed, resulting in a NULL byte overflow
(https://github.com/COVESA/dlt-daemon/blob/master/include/dlt/dlt_common.h#L323)

## Test environment
- OS: Ubuntu 22.04
- gcc: 11.4.0
- DLT Package Version: 2.18.10 STABLE
- Package Revision: v2.18.10_34_ga465513

## Attachment
[Attachment.zip](https://github.com/COVESA/dlt-daemon/files/14799996/Attachment.zip)
Attaching the DLT file capable of triggering the vulnerability and the ASAN report.
The vulnerability can be reproduced by executing the command `dlt-convert -a ./poc.dlt`.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.