Summary An Out-of-Bound Read vulnerability was discovered in the <

Multiple Out-of-Bound Read in parseAarqPdu /src/libiec61850/src/mms/iso_acse/acse.c about libiec61850 HOT 1 OPEN

gnbon commented on August 17, 2024

Multiple Out-of-Bound Read in parseAarqPdu /src/libiec61850/src/mms/iso_acse/acse.c

from libiec61850.

Comments (1)

gnbon commented on August 17, 2024

In fix 501dffe, there is still an issue that can occur below:
If the BerDecoder_decodeLength function is called at the end of the file and returns -1, the boundary check will fail to detect the problem. This is because when len is equal to 0, the code will continue at line 284.

libiec61850/src/mms/iso_acse/acse.c

Lines 276 to 284 in d0f52a2

 while (bufPos < maxBufPos) 

 { 

 uint8_t tag = buffer[bufPos++]; 

 int len; 

 bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 

 if (len == 0) 

 continue;

In this case, line 278 will end up referencing buffer[-1].
poc-oobr-60.zip

from libiec61850.

Related Issues (20)

Error when writing all array elements at once HOT 1
Client Report Handler in Python HOT 1
NBReports generated despite IedServer_lockDataModel(), IedServer_lockDataModel() HOT 2
Structure data object from MmsVariableSpecification is diffrent with value when received dataset from rcb HOT 3
iec61850_client_example_files: Failed to get file!
Incompatibility between 1.5.1 and 1.5.3
heap-buffer-overflow in BerEncoder_encodeLength of /src/libiec61850/src/mms/asn1/ber_encoder.c HOT 1
MmsValue_encode/decodeMmsData fails on Visible String attribute with empty payload
Is there any peach pits to describe this protocol?
libiec61850-1.5 goose build fail HOT 1
Out-of-Bound Read in /src/libiec61850/src/goose/goose_receiver.c:665:9 in parseGoosePayload
Out-of-Bound Read in BerDecoder_decodeBoolean /src/libiec61850/src/mms/asn1/ber_decode.c:218:9 HOT 1
Out-of-Bound Read in parseAarePdu /src/libiec61850/src/mms/iso_acse/acse.c:215:17 HOT 1
Integrate Fuzzers into OSS-Fuzz and Expand Fuzzing Coverage HOT 2
Out-of-Bound Write in BerEncoder_encodeBitString /src/libiec61850/src/mms/asn1/ber_encoder.c:147:26
Uninitialized memory access in IedServer_createWithConfig
Create model from config file failed when there is no physical address for GSEControl and SampledValueControl
DynamicModelGenerator java tool
function ControlObjectClient_select here the "$SBO"node name should be "$SBOw" HOT 1

Multiple Out-of-Bound Read in parseAarqPdu /src/libiec61850/src/mms/iso_acse/acse.c about libiec61850 HOT 1 OPEN

Comments (1)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	while (bufPos < maxBufPos)
	{
	uint8_t tag = buffer[bufPos++];
	int len;

	bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos);

	if (len == 0)
	continue;