microsoft / microsoft/ebpf-for-windows
Bugs in `bpf_prog_test_run_opts()`
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
There are couple of issues with the current `bpf_prog_test_run_opts()` API implementation:
1. In the case when `ctx_in` passed to the above API is not NULL but `ctx_out` is NULL (which seems to be a valid scenario), ebpfcore assumes that the `ctx_out` is also not NULL (and of the same size as `ctx_in`), and overwrites the data in the `data_out` with `ctx_out`, corrupting the value in `data_out`. There is no buffer overflow, but `data_out` is corrupted.
2. In the case when `data_out` buffer size provider by user mode app is more than actual `data_out` returned by extension after BPF program invocation, ebpfcore ignores the initial `data_out` size, and starts copying `ctx_out` in the `data_out` buffer.
Contributor guide
Assessment
This issue has not been assessed yet.