Bug #3974
closedUnsafe casts in ndn::nfd::*::wireDecode()
100%
Description
Fields such as FacePersistency
, FaceScope
, LinkType
are defined as 8-bit long enumerations. However, when they're being decoded from a TLV block, the nonNegativeInteger value, which can be as long as a uint64_t
, is simply cast to the target type, without any range checks. The result of this operation is unspecified (undefined behavior since C++17) if the value, converted to the enumeration's underlying type (uint8_t
), is out of the enumeration's range.
An example of buggy code in ndn::nfd::FaceStatus
is:
m_faceScope = static_cast<FaceScope>(readNonNegativeInteger(*val));
This can be considered a security vulnerability, because it's trivial to craft packets that remotely trigger the unspecified/undefined behavior.
The same applies to several other unsafe casts throughout the management module, and possibly elsewhere.