Skip to content

Commit

Permalink
HTTP: fix heap-buffer-overflow
Browse files Browse the repository at this point in the history
```
=================================================================
==673246==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5080000002fd at pc 0x555c6a22eca2 bp 0x7ffe1db9b290 sp 0x7ffe1db9aa48
READ of size 1 at 0x5080000002fd thread T0
    #0 0x555c6a22eca1 in strncpy (/home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet+0x53aca1) (BuildId: 464e7474cde3de91c01588c7ea0161a05ddd6b63)
    ntop#1 0x555c6a462a9d in ndpi_http_check_content /home/ivan/svnrepos/nDPI/src/lib/protocols/http.c:309:8
    ntop#2 0x555c6a45a9a0 in check_content_type_and_change_protocol /home/ivan/svnrepos/nDPI/src/lib/protocols/http.c:901:46
    ntop#3 0x555c6a4526ce in process_response /home/ivan/svnrepos/nDPI/src/lib/protocols/http.c:1280:3
    ntop#4 0x555c6a44f90f in ndpi_check_http_tcp /home/ivan/svnrepos/nDPI/src/lib/protocols/http.c:1373:9
    ntop#5 0x555c6a44f475 in ndpi_search_http_tcp /home/ivan/svnrepos/nDPI/src/lib/protocols/http.c:1459:3
    ntop#6 0x555c6a348520 in check_ndpi_detection_func /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:5949:6
    ntop#7 0x555c6a348f2f in check_ndpi_tcp_flow_func /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:5997:12
    ntop#8 0x555c6a348bcf in ndpi_check_flow_func /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:6016:12
    ntop#9 0x555c6a359e26 in ndpi_internal_detection_process_packet /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:7017:15
    ntop#10 0x555c6a355f6f in ndpi_detection_process_packet /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:7184:22
    ntop#11 0x555c6a284958 in LLVMFuzzerTestOneInput /home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet.c:24:5
```

Found by oss-fuzz.
See: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60557
Fix: 0b0f255
  • Loading branch information
IvanNardi committed Jul 12, 2023
1 parent 669a02c commit 4ebc258
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions src/lib/protocols/http.c
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,7 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo
flow->http.filename[filename_len-1] = '\0';
}
}
else{
else if(filename_len >= 2) {
//case: filename="file_name"
flow->http.filename = ndpi_malloc(filename_len-1);

Expand All @@ -310,8 +310,7 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo
flow->http.filename[filename_len-2] = '\0';
}
}
}
else{
} else {
//case: filename=file_name
flow->http.filename = ndpi_malloc(filename_len+1);

Expand Down

0 comments on commit 4ebc258

Please sign in to comment.