Project

General

Profile

Actions

Bug #3974

closed

Unsafe casts in ndn::nfd::*::wireDecode()

Added by Davide Pesavento about 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Management
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
3.00 h

Description

Fields such as FacePersistency, FaceScope, LinkType are defined as 8-bit long enumerations. However, when they're being decoded from a TLV block, the nonNegativeInteger value, which can be as long as a uint64_t, is simply cast to the target type, without any range checks. The result of this operation is unspecified (undefined behavior since C++17) if the value, converted to the enumeration's underlying type (uint8_t), is out of the enumeration's range.

An example of buggy code in ndn::nfd::FaceStatus is:

  m_faceScope = static_cast<FaceScope>(readNonNegativeInteger(*val));

This can be considered a security vulnerability, because it's trivial to craft packets that remotely trigger the unspecified/undefined behavior.

The same applies to several other unsafe casts throughout the management module, and possibly elsewhere.


Related issues 2 (0 open2 closed)

Related to ndn-cxx - Bug #3497: Mgmt/Nfd/TestControlCommand/Face{Enable,Disable}LocalControl undefined behaviorClosed

Actions
Related to ndn-cxx - Bug #3200: Type mismatch in Selectors, MetaInfo, SignatureInfo, and ControlResponseClosedJunxiao Shi

Actions
Actions

Also available in: Atom PDF