Excessive recursion in MongoDB extension may lead to crash
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 428
Description
*Title*: *Excessive recursion in MongoDB extension may lead to crash*
*Description*:
Clarification - This is reported here and not to the "envoy-security" mailing group, per the request of that mailing group, since the MongoDB extension is outside of the security threat scope.
The DecoderImpl::fromBuffer function in [bson_impl.cc](https://github.com/envoyproxy/envoy/blob/027d6ca15adeae8cd478fcce67fc24322318e52e/source/extensions/filters/network/mongo_proxy/bson_impl.cc#L370) parses BSON buffers into structures representing them. The code [reads the byte](https://github.com/envoyproxy/envoy/blob/027d6ca15adeae8cd478fcce67fc24322318e52e/source/extensions/filters/network/mongo_proxy/bson_impl.cc#L392) that represents the type of the next element of the message and then creates the structure that represents this type and adds it to its parent element. Some of the elements are decoded by the same DecoderImpl::fromBuffer itself, such as the Document element, causing a [recursion](https://github.com/envoyproxy/envoy/blob/027d6ca15adeae8cd478fcce67fc24322318e52e/source/extensions/filters/network/mongo_proxy/bson_impl.cc#L419). Since there is no code that checks the recursion depth, it is possible to make the code recurse again and again (even when parsing a relatively small packet) until the stack is exhausted and the process crashes.
*Repro steps*:
1. Configure envoy with the configuration specified in the *Config* section
2. Run the following Python script -
(Script assumes Envoy on 192.168.188.133:10000, Script may need to be executed several times before causing a crash)
```python
from socket import *
import struct
s = socket(AF_INET, SOCK_STREAM)
s.connect(("192.168.188.133", 10000)) # Change to Envoy IP address
inner_data = '\x03a\x00'
my_data = '\x07\x00\x00\x00\x03a\x00'
for i in range(6000):
my_data = struct.pack("
Contributor guide
Assessment
This issue has not been assessed yet.