Skip to content

Security: Fix critical buffer overflow vulnerabilities (CVSS 9.8) #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Security: Fix critical buffer overflow vulnerabilities (CVSS 9.8) #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6f64a9b
Security: Fix critical buffer overflow vulnerabilities in libsam3 SAM…
lancejames221b Aug 14, 2025
a5dcc77
Security: Fix compilation warnings in libsam3a.c
lancejames221b Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 54 additions & 16 deletions src/libsam3/libsam3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,7 +389,8 @@ int sam3udpSendToIP(uint32_t ip, int port, const void *buf, size_t bufSize) {

int sam3udpSendTo(const char *hostname, int port, const void *buf,
size_t bufSize, uint32_t *ip) {
struct hostent *host = NULL;
struct addrinfo hints, *result = NULL;
int status;
// TODO: ipv6
if (buf == NULL || bufSize < 1)
return -1;
Expand All @@ -398,17 +399,24 @@ int sam3udpSendTo(const char *hostname, int port, const void *buf,
if (port < 1 || port > 65535)
port = 7655;
//
host = gethostbyname(hostname);
if (host == NULL || host->h_name == NULL || !host->h_name[0]) {
memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET;
hints.ai_socktype = SOCK_DGRAM;
//
status = getaddrinfo(hostname, NULL, &hints, &result);
if (status != 0 || result == NULL) {
if (libsam3_debug)
fprintf(stderr, "ERROR: can't resolve '%s'\n", hostname);
fprintf(stderr, "ERROR: can't resolve '%s': %s\n", hostname, gai_strerror(status));
if (result) freeaddrinfo(result);
return -1;
}
//
struct sockaddr_in *saddr = (struct sockaddr_in *)result->ai_addr;
uint32_t addr_ip = saddr->sin_addr.s_addr;
if (ip != NULL)
*ip = ((struct in_addr *)host->h_addr)->s_addr;
return sam3udpSendToIP(((struct in_addr *)host->h_addr)->s_addr, port, buf,
bufSize);
*ip = addr_ip;
freeaddrinfo(result);
return sam3udpSendToIP(addr_ip, port, buf, bufSize);
}

////////////////////////////////////////////////////////////////////////////////
Expand Down Expand Up @@ -770,9 +778,21 @@ int sam3GenerateKeys(Sam3Session *ses, const char *hostname, int port,
strcpyerr(ses, "PRIVKEY_ERROR");
}
const char *pub = sam3FindField(rep, "PUB");
strcpy(ses->pubkey, pub);
if (pub == NULL || strlen(pub) >= sizeof(ses->pubkey)) {
strcpyerr(ses, "PUBKEY_SIZE_ERROR");
sam3FreeFieldList(rep);
sam3tcpDisconnect(fd);
return -1;
}
snprintf(ses->pubkey, sizeof(ses->pubkey), "%s", pub);
const char *priv = sam3FindField(rep, "PRIV");
strcpy(ses->privkey, priv);
if (priv == NULL || strlen(priv) >= sizeof(ses->privkey)) {
strcpyerr(ses, "PRIVKEY_SIZE_ERROR");
sam3FreeFieldList(rep);
sam3tcpDisconnect(fd);
return -1;
}
snprintf(ses->privkey, sizeof(ses->privkey), "%s", priv);
res = 0;
//
sam3FreeFieldList(rep);
Expand Down Expand Up @@ -803,9 +823,13 @@ int sam3NameLookup(Sam3Session *ses, const char *hostname, int port,
//
if (strcmp(rs, "OK") == 0) {
if (pub != NULL && sam3CheckValidKeyLength(pub)) {
strcpy(ses->destkey, pub);
strcpyerr(ses, NULL);
res = 0;
if (strlen(pub) >= sizeof(ses->destkey)) {
strcpyerr(ses, "DESTKEY_SIZE_ERROR");
} else {
snprintf(ses->destkey, sizeof(ses->destkey), "%s", pub);
strcpyerr(ses, NULL);
res = 0;
}
}
} else if (rs[0]) {
strcpyerr(ses, rs);
Expand Down Expand Up @@ -941,7 +965,11 @@ int sam3CreateSession(Sam3Session *ses, const char *hostname, int port,
fprintf(stderr, "ERROR, Unexpected key size (%li)!\n", strlen(v));
goto error;
}
strcpy(ses->privkey, v);
if (v == NULL || strlen(v) >= sizeof(ses->privkey)) {
strcpyerr(ses, "PRIVKEY_SIZE_ERROR");
return -1;
}
snprintf(ses->privkey, sizeof(ses->privkey), "%s", v);
sam3FreeFieldList(rep);
// get public key
if (sam3tcpPrintf(ses->fd, "NAMING LOOKUP NAME=ME\n") < 0)
Expand All @@ -960,7 +988,11 @@ int sam3CreateSession(Sam3Session *ses, const char *hostname, int port,
sam3FreeFieldList(rep);
goto error;
}
strcpy(ses->pubkey, v);
if (v == NULL || strlen(v) >= sizeof(ses->pubkey)) {
strcpyerr(ses, "PUBKEY_SIZE_ERROR");
return -1;
}
snprintf(ses->pubkey, sizeof(ses->pubkey), "%s", v);
sam3FreeFieldList(rep);
//
if (libsam3_debug)
Expand Down Expand Up @@ -1022,7 +1054,10 @@ Sam3Connection *sam3StreamConnect(Sam3Session *ses, const char *destkey) {
}
sam3FreeFieldList(rep);
if (conn != NULL) {
strcpy(conn->destkey, destkey);
if (destkey == NULL || strlen(destkey) >= sizeof(conn->destkey)) {
return NULL;
}
snprintf(conn->destkey, sizeof(conn->destkey), "%s", destkey);
conn->ses = ses;
conn->next = ses->connlist;
ses->connlist = conn;
Expand Down Expand Up @@ -1090,7 +1125,10 @@ Sam3Connection *sam3StreamAccept(Sam3Session *ses) {
goto error;
}
sam3FreeFieldList(rep);
strcpy(conn->destkey, repstr);
if (strlen(repstr) >= sizeof(conn->destkey)) {
return NULL;
}
snprintf(conn->destkey, sizeof(conn->destkey), "%s", repstr);
conn->ses = ses;
conn->next = ses->connlist;
ses->connlist = conn;
Expand Down
96 changes: 75 additions & 21 deletions src/libsam3a/libsam3a.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,17 +158,29 @@ static int sam3aBytesAvail(int fd) {
}

static uint32_t sam3aResolveHost(const char *hostname) {
struct hostent *host;
struct addrinfo hints, *result = NULL;
int status;
uint32_t addr_ip = 0;
//
if (hostname == NULL || !hostname[0])
return 0;
if ((host = gethostbyname(hostname)) == NULL || host->h_name == NULL ||
!host->h_addr_list[0][0]) {
//
memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET;
hints.ai_socktype = SOCK_STREAM;
//
status = getaddrinfo(hostname, NULL, &hints, &result);
if (status != 0 || result == NULL) {
if (libsam3a_debug)
fprintf(stderr, "ERROR: can't resolve '%s'\n", hostname);
fprintf(stderr, "ERROR: can't resolve '%s': %s\n", hostname, gai_strerror(status));
if (result) freeaddrinfo(result);
return 0;
}
return ((struct in_addr *)host->h_addr_list[0])->s_addr;
//
struct sockaddr_in *saddr = (struct sockaddr_in *)result->ai_addr;
addr_ip = saddr->sin_addr.s_addr;
freeaddrinfo(result);
return addr_ip;
}

static int sam3aConnect(uint32_t ip, int port, int *complete) {
Expand Down Expand Up @@ -431,21 +443,31 @@ int sam3audpSendToIP (uint32_t ip, int port, const void *buf, int bufSize) {


int sam3audpSendTo (const char *hostname, int port, const void *buf, int
bufSize, uint32_t *ip) { struct hostent *host = NULL;
bufSize, uint32_t *ip) {
struct addrinfo hints, *result = NULL;
int status;
//
if (buf == NULL || bufSize < 1) return -1;
if (hostname == NULL || !hostname[0]) hostname = "localhost";
if (port < 1 || port > 65535) port = 7655;
//
host = gethostbyname(hostname);
if (host == NULL || host->h_name == NULL || !host->h_name[0]) {
if (libsam3a_debug) fprintf(stderr, "ERROR: can't resolve '%s'\n",
hostname); return -1;
memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET;
hints.ai_socktype = SOCK_DGRAM;
//
status = getaddrinfo(hostname, NULL, &hints, &result);
if (status != 0 || result == NULL) {
if (libsam3a_debug) fprintf(stderr, "ERROR: can't resolve '%s': %s\n",
hostname, gai_strerror(status));
if (result) freeaddrinfo(result);
return -1;
}
//
if (ip != NULL) *ip = ((struct in_addr *)host->h_addr)->s_addr;
return sam3audpSendToIP(((struct in_addr *)host->h_addr)->s_addr, port, buf,
bufSize);
struct sockaddr_in *saddr = (struct sockaddr_in *)result->ai_addr;
uint32_t addr_ip = saddr->sin_addr.s_addr;
if (ip != NULL) *ip = addr_ip;
freeaddrinfo(result);
return sam3audpSendToIP(addr_ip, port, buf, bufSize);
}
*/

Expand Down Expand Up @@ -989,7 +1011,11 @@ static void aioSesNameMeChecker(Sam3ASession *ses) {
sam3aFreeFieldList(rep);
return;
}
strcpy(ses->pubkey, v);
if (v == NULL || strlen(v) >= sizeof(ses->pubkey)) {
strcpyerrs(ses, "PUBKEY_SIZE_ERROR");
return;
}
snprintf(ses->pubkey, sizeof(ses->pubkey), "%s", v);
sam3aFreeFieldList(rep);
//
ses->cbAIOProcessorR = ses->cbAIOProcessorW = NULL;
Expand Down Expand Up @@ -1017,7 +1043,11 @@ static void aioSesCreateChecker(Sam3ASession *ses) {
}
// ok
// fprintf(stderr, "\nPK: %s\n", v);
strcpy(ses->privkey, v);
if (v == NULL || strlen(v) >= sizeof(ses->privkey)) {
strcpyerrs(ses, "PRIVKEY_SIZE_ERROR");
return;
}
snprintf(ses->privkey, sizeof(ses->privkey), "%s", v);
sam3aFreeFieldList(rep);
// get our public key
if (aioSesSendCmdWaitReply(ses, aioSesNameMeChecker, "%s\n",
Expand Down Expand Up @@ -1076,7 +1106,11 @@ int sam3aCreateSessionEx(Sam3ASession *ses, const Sam3ASessionCallbacks *cb,
goto error;
if (privkey == NULL)
privkey = "TRANSIENT";
strcpy(ses->privkey, privkey);
if (privkey == NULL || strlen(privkey) >= sizeof(ses->privkey)) {
strcpyerrs(ses, "PRIVKEY_SIZE_ERROR");
return -1;
}
snprintf(ses->privkey, sizeof(ses->privkey), "%s", privkey);
if (params != NULL && (ses->params = strdup(params)) == NULL)
goto error;
ses->timeoutms = timeoutms;
Expand Down Expand Up @@ -1153,8 +1187,18 @@ static void aioSesKeyGenChecker(Sam3ASession *ses) {
//
if (pub != NULL && strlen(pub) == SAM3A_PUBKEY_SIZE && priv != NULL &&
strlen(priv) == SAM3A_PRIVKEY_SIZE) {
strcpy(ses->pubkey, pub);
strcpy(ses->privkey, priv);
if (pub == NULL || strlen(pub) >= sizeof(ses->pubkey)) {
strcpyerrs(ses, "PUBKEY_SIZE_ERROR");
sam3aFreeFieldList(rep);
return;
}
snprintf(ses->pubkey, sizeof(ses->pubkey), "%s", pub);
if (priv == NULL || strlen(priv) >= sizeof(ses->privkey)) {
strcpyerrs(ses, "PRIVKEY_SIZE_ERROR");
sam3aFreeFieldList(rep);
return;
}
snprintf(ses->privkey, sizeof(ses->privkey), "%s", priv);
sam3aFreeFieldList(rep);
if (ses->cb.cbCreated != NULL)
ses->cb.cbCreated(ses);
Expand Down Expand Up @@ -1224,7 +1268,11 @@ static void aioSesNameResChecker(Sam3ASession *ses) {
//
if (strcmp(rs, "OK") == 0) {
if (pub != NULL && strlen(pub) == SAM3A_PUBKEY_SIZE) {
strcpy(ses->destkey, pub);
if (pub == NULL || strlen(pub) >= sizeof(ses->destkey)) {
strcpyerrs(ses, "DESTKEY_SIZE_ERROR");
} else {
snprintf(ses->destkey, sizeof(ses->destkey), "%s", pub);
}
sam3aFreeFieldList(rep);
if (ses->cb.cbCreated != NULL)
ses->cb.cbCreated(ses);
Expand Down Expand Up @@ -1559,7 +1607,10 @@ Sam3AConnection *sam3aStreamConnectEx(Sam3ASession *ses,
return NULL;
if (cb != NULL)
conn->cb = *cb;
strcpy(conn->destkey, destkey);
if (destkey == NULL || strlen(destkey) >= sizeof(conn->destkey)) {
return NULL;
}
snprintf(conn->destkey, sizeof(conn->destkey), "%s", destkey);
conn->timeoutms = timeoutms;
//
conn->aio.udata = aioConConnectHandshacked;
Expand Down Expand Up @@ -1591,7 +1642,10 @@ static void aioConnAcceptCheckerA(Sam3AConnection *conn) {
return;
}
sam3aFreeFieldList(rep);
strcpy(conn->destkey, conn->aio.data);
if (conn->aio.data == NULL || strlen((char*)conn->aio.data) >= sizeof(conn->destkey)) {
return;
}
snprintf(conn->destkey, sizeof(conn->destkey), "%s", (char*)conn->aio.data);
conn->callDisconnectCB = 1;
conn->cbAIOProcessorR = aioConnDataReader;
conn->cbAIOProcessorW = aioConnDataWriter;
Expand Down