Stack Buffer Overflow Issues Report

Stack Buffer Overflow Issues Report

Commit id: 0e66f3f8337ad9790c9ac4e5c186b4da68ae92b2

Affect version: ≤ 4.1.0

1. Stack Buffer Overflow in at_gethostbyname

In file components/net/at/at_socket/at_socket.c , function at_gethostbyname, the incoming parameter name should be a domain name. When a non-alphabetic string exceeding 16 bytes is encountered, a stack overflow will occur in line 1143, because the destination address ip_str of strcpy only has a capacity of 16 bytes.

When the name parameter is controlled by a malicious attacker, the attacker can use this stack overflow to hijack the return address of the function, so that the attacker can execute remote code and control the entire system.

https://github.com/RT-Thread/rt-thread/blob/0e66f3f8337ad9790c9ac4e5c186b4da68ae92b2/components/net/at/at_socket/at_socket.c#L1107-L1144

2. Stack Buffer Overflow in at_getaddrinfo

In file components/net/at/at_socket/at_socket.c , function at_getaddrinfo , the incoming parameter nodename should be a domain name. When a non-alphabetic string exceeding 16 bytes is encountered, a stack overflow will occur in line 1251, because the destination address ip_str of strcpy only has a capacity of 16 bytes.

When the nodename parameter is controlled by a malicious attacker, the attacker can use this stack overflow to hijack the return address of the function, so that the attacker can execute remote code and control the entire system.

https://github.com/RT-Thread/rt-thread/blob/0e66f3f8337ad9790c9ac4e5c186b4da68ae92b2/components/net/at/at_socket/at_socket.c#L1171-L1181

https://github.com/RT-Thread/rt-thread/blob/0e66f3f8337ad9790c9ac4e5c186b4da68ae92b2/components/net/at/at_socket/at_socket.c#L1235-L1253

Please check the overflow issues above and add the corresponding constraints if necessary.

Start in components/net/at/at_socket/at_socket.c at at_gethostbyname and at_getaddrinfo, especially the cited lines around each strcpy call. Exercise both functions with non-alphabetic names longer than 16 bytes and inspect how their input constraints are enforced. Done means neither function permits the reported stack overflow and the behavior is covered by suitable regression checks.