alibaba / alibaba/AliOS-Things

[Bug Report]: 关于frontend_main.c缺乏参数检查导致null pointer dereference漏洞

Open
#2,023 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
4.6k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

### Contact Details

_No response_

### What happened?

# frontend_main.c参数检查漏洞

## 基本信息

我联系您是为了报告在最新版本的AliOS-Things 中发现的潜在漏洞。我在此开设此issue以供您审查。如果确认存在漏洞,请告知我是否计划申请 CVE ID。如有需要,我很乐意提供任何额外的细节或澄清。

## 概要

在代码 AliOS-Things/components/ai_agent/src/engine/tflite-micro/tensorflow/lite/experimental/microfrontend/lib/frontend_main.c 中,对参数数量未作检查并直接使用第二个命令行参数,由于用户可能只提供给一个参数(即argv[0]),而不提供argv[0],因此,可能导致 CWE NULL 指针解引用[CWE-476]("https://cwe.mitre.org/data/definitions/476.html")。

## 漏洞代码

```
int main(int argc, char** argv) {
struct FrontendConfig frontend_config;
FrontendFillConfigWithDefaults(&frontend_config);

char* filename = argv[1]; // argc在没有被检查的情况下将argv[1]的内容赋值给了指针并在fprintf中使用。
int sample_rate = 16000;

struct FrontendState frontend_state;
if (!FrontendPopulateState(&frontend_config, &frontend_state, sample_rate)) {
fprintf(stderr, "Failed to populate frontend state\n");
FrontendFreeStateContents(&frontend_state);
return 1;
}

FILE* fp = fopen(filename, "r");
if (fp == NULL) {
fprintf(stderr, "Failed to open %s for read\n", filename);
return 1;
}
fseek(fp, 0L, SEEK_END);
size_t audio_file_size = ftell(fp) / sizeof(int16_t);
fseek(fp, 0L, SEEK_SET);
int16_t* audio_data = malloc(audio_file_size * sizeof(int16_t));
int16_t* original_audio_data = audio_data;
if (audio_file_size !=
fread(audio_data, sizeof(int16_t), audio_file_size, fp)) {
fprintf(stderr, "Failed to read in all audio data\n");
fclose(fp);
return 1;
}

while (audio_file_size > 0) {
size_t num_samples_read;
struct FrontendOutput output = FrontendProcessSamples(
&frontend_state, audio_data, audio_file_size, &num_samples_read);
audio_data += num_samples_read;
audio_file_size -= num_samples_read;

if (output.values != NULL) {
int i;
for (i = 0; i < output.size; ++i) {
printf("%d ", output.values[i]);
}
printf("\n");
}
}

FrontendFreeStateContents(&frontend_state);
free(original_audio_data);
fclose(fp);
return 0;
}
```

### 漏洞描述

该函数接收用户输入。然而,它对用户参数数量未作检查,而直接使用可能不存在的用户参数。该漏洞可能导致 CWE NULL 指针解引用[CWE-476]("https://cwe.mitre.org/data/definitions/476.html")。

### Version

master (Default)

### What soultions are you seeing the problem on?

_No response_

### Relevant log output

_No response_

Contributor guide

Open the contributing guide

Research direction

Open AliOS-Things/components/ai_agent/src/engine/tflite-micro/tensorflow/lite/experimental/microfrontend/lib/frontend_main.c and inspect the main entry point's argc/argv handling. Run the frontend executable without an input filename and confirm it exits safely with an error; done means the missing argument no longer reaches file-opening or error-reporting paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
embedded-iot, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.