libretro / libretro/RetroArch

[Bug]: Security Vulnerability - Action Required: Heap-based Buffer Overflow vulnerability may in your project

Open
#16,972 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.1k
Forks
2.2k
Avg merge
7h 35m
Merged PRs (30d)
51

Description

Hi, there
we have detected that your project may be vulnerable to Heap-based Buffer Overflow. It shares similarities to a recent CVE disclosure CVE-2023-6992 in the https://github.com/freeswitch/sofia-sip. The affected file and functions are as follows:

  1. deflate_stored (deflate_state *s,int flush) in the file of deps/libz/deflate.c

The source vulnerability information is as follows:

Vulnerability Detail:
CVE Identifier: CVE-2023-6992
Description: Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.
Reference:https://nvd.nist.gov/vuln/detail/CVE-2023-6992
Patch:https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading deps/libz/deflate.c, focusing on deflate_stored (deflate_state *s, int flush), then compare the reported CVE-2023-6992 details with the referenced Cloudflare zlib patch. Done means establishing whether RetroArch's bundled code is affected and recording the applicable security outcome or required change.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.