fix(hk): guard data_len underflow in hk_param_sniffer on short sport-… - #11
Closed
MahmoodSeoud wants to merge 2 commits into
Closed
fix(hk): guard data_len underflow in hk_param_sniffer on short sport-…#11MahmoodSeoud wants to merge 2 commits into
MahmoodSeoud wants to merge 2 commits into
Conversation
…13 packets
hk_param_sniffer() treats any packet whose CSP source port is 13 as an HK param
stream and computes the payload length as:
size_t data_len = packet->length - 5 - ((flags & CSP_FRDP) ? 5 : 0);
data_len is unsigned, so any packet on sport 13 shorter than that 5/10-byte
overhead -- e.g. a short RDP control/ack frame, or any other service that shares
the port -- underflows data_len to ~SIZE_MAX. param_queue_init() and the mpack
reader are then pointed at buffer..buffer+SIZE_MAX and walk off the end of the
packet: an out-of-bounds read that segfaults the param sniffer under
`prometheus start`.
Guard the subtraction: a packet too short to carry a param payload is skipped.
Adds tests/hk_sniffer_host.c (fork-isolated) which feeds the real
hk_param_sniffer() short sport-13 packets and asserts they are skipped; fails
without the guard, passes with it. Wired as hk_sniffer_tests in tests/meson.build.
README gains a Testing section.
Author
|
already included in the master branch with differetn wording |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…13 packets
hk_param_sniffer() treats any packet whose CSP source port is 13 as an HK param stream and computes the payload length as:
data_len is unsigned, so any packet on sport 13 shorter than that 5/10-byte overhead -- e.g. a short RDP control/ack frame, or any other service that shares the port -- underflows data_len to ~SIZE_MAX. param_queue_init() and the mpack reader are then pointed at buffer..buffer+SIZE_MAX and walk off the end of the packet: an out-of-bounds read that segfaults the param sniffer under
prometheus start.Guard the subtraction: a packet too short to carry a param payload is skipped.
Adds tests/hk_sniffer_host.c (fork-isolated) which feeds the real hk_param_sniffer() short sport-13 packets and asserts they are skipped; fails without the guard, passes with it. Wired as hk_sniffer_tests in tests/meson.build. README gains a Testing section.