microsoft / microsoft/ebpf-for-windows

Bugs in `bpf_prog_test_run_opts()`

Open
#4,441 1 comment 0 reactions 1 assignee Claimed by @kumarvin123 View on GitHub
bug P3 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

There are couple of issues with the current `bpf_prog_test_run_opts()` API implementation:

1. In the case when `ctx_in` passed to the above API is not NULL but `ctx_out` is NULL (which seems to be a valid scenario), ebpfcore assumes that the `ctx_out` is also not NULL (and of the same size as `ctx_in`), and overwrites the data in the `data_out` with `ctx_out`, corrupting the value in `data_out`. There is no buffer overflow, but `data_out` is corrupted.
2. In the case when `data_out` buffer size provider by user mode app is more than actual `data_out` returned by extension after BPF program invocation, ebpfcore ignores the initial `data_out` size, and starts copying `ctx_out` in the `data_out` buffer.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.