Skip to content

Commit b65a755

Browse files
authored
Fix a memory access error and some leaks (#2425)
``` SCARINESS: 12 (1-byte-read-heap-buffer-overflow) #0 0x557f3a5b5100 in ndpi_get_host_domain /src/ndpi/src/lib/ndpi_domains.c:158:8 #1 0x557f3a59b561 in ndpi_check_dga_name /src/ndpi/src/lib/ndpi_main.c:10412:17 #2 0x557f3a51163a in process_chlo /src/ndpi/src/lib/protocols/quic.c:1467:7 #3 0x557f3a469f4b in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_quic_get_crypto_data.c:44:7 #4 0x557f3a46abc8 in NaloFuzzerTestOneInput (/out/fuzz_quic_get_crypto_data+0x4cfbc8) ``` Some notes about the leak: if the insertion into the uthash fails (because of an allocation failure), we need to free the just allocated entry. But the only way to check if the `HASH_ADD_*` failed, is to perform a new lookup: a bit costly, but we don't use that code in the fast-path. See also efb261a Credits for finding the issues to Philippe Antoine (@catenacyber) and his `nallocfuzz` fuzzing engine See: https://github.com/catenacyber/nallocfuzz See: google/oss-fuzz#9902
1 parent 7c6910d commit b65a755

File tree

2 files changed

+9
-2
lines changed

2 files changed

+9
-2
lines changed

src/lib/ndpi_domains.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ const char* ndpi_get_host_domain(struct ndpi_detection_module_struct *ndpi_str,
148148

149149
dot = strstr(hostname, ret);
150150

151-
if(dot == NULL)
151+
if(dot == NULL || dot == hostname)
152152
return(hostname);
153153

154154
dot--;

src/lib/ndpi_utils.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2320,7 +2320,7 @@ int ndpi_hash_find_entry(ndpi_str_hash *h, char *key, u_int key_len, u_int16_t *
23202320

23212321
int ndpi_hash_add_entry(ndpi_str_hash **h, char *key, u_int8_t key_len, u_int16_t value) {
23222322
ndpi_str_hash_priv *h_priv = (ndpi_str_hash_priv *)*h;
2323-
ndpi_str_hash_priv *item;
2323+
ndpi_str_hash_priv *item, *ret_found;
23242324

23252325
if(!key || key_len == 0)
23262326
return(3);
@@ -2350,6 +2350,13 @@ int ndpi_hash_add_entry(ndpi_str_hash **h, char *key, u_int8_t key_len, u_int16_
23502350

23512351
HASH_ADD(hh, *((ndpi_str_hash_priv **)h), key[0], key_len, item);
23522352

2353+
HASH_FIND(hh, *((ndpi_str_hash_priv **)h), key, key_len, ret_found);
2354+
if(ret_found == NULL) { /* The insertion failed (because of a memory allocation error) */
2355+
ndpi_free(item->key);
2356+
ndpi_free(item);
2357+
return 4;
2358+
}
2359+
23532360
return 0;
23542361
}
23552362

0 commit comments

Comments
 (0)