NULL byte overflow in dlt_message_argument_print
- Dominant language
- C
- Stars
- 459
- Forks
- 340
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 2
Description
## Summary
A buffer overflow vulnerability exists in the DLT_MSG_READ_STRING function called by the dlt_message_argument_print function.
NULL byte overflow occurs when copying a string of DLT_CONVERT_TEXTBUFSIZE (10024) length.
## Details
1. Execute dlt-convert with the -a argument, using a DLT file containing a string of length DLT_CONVERT_TEXTBUFSIZE
2. The functions are called in the following sequence:
`dlt_message_payload` -> `dlt_message_argument_print` -> `DLT_MSG_READ_STRING`
3. After the execution of memcpy and dlt_clean_string functions, the statement dst[length] = 0 is executed, resulting in a NULL byte overflow
(https://github.com/COVESA/dlt-daemon/blob/master/include/dlt/dlt_common.h#L323)
## Test environment
- OS: Ubuntu 22.04
- gcc: 11.4.0
- DLT Package Version: 2.18.10 STABLE
- Package Revision: v2.18.10_34_ga465513
## Attachment
[Attachment.zip](https://github.com/COVESA/dlt-daemon/files/14799996/Attachment.zip)
Attaching the DLT file capable of triggering the vulnerability and the ASAN report.
The vulnerability can be reproduced by executing the command `dlt-convert -a ./poc.dlt`.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.