Fix vuln OSV-2024-947 #1699
Open
Fix vuln OSV-2024-947 #1699
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## dev #1699 +/- ##
==========================================
- Coverage 83.16% 83.15% -0.01%
==========================================
Files 279 279
Lines 48536 48538 +2
Branches 10507 10508 +1
==========================================
- Hits 40363 40361 -2
- Misses 7046 7047 +1
- Partials 1127 1130 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
@aled-ua could you check why the CI failed? |
|
emmm, I'm not sure. Looks like the download failed? |
seladb
reviewed
Mar 20, 2025
Comment on lines
490
to
+496
| while (remainingLen > 0) | ||
| { | ||
| // Ensure there is enough remaining length for a new entry | ||
| if (remainingLen < sizeof(SomeIpSdEntry::someipsdhdrentry)) | ||
| { | ||
| break; | ||
| } |
There was a problem hiding this comment.
Can't we do:
while (remainingLen > sizeof(SomeIpSdEntry::someipsdhdrentry))
{
entry = new SomeIpSdEntry(this, offset);
...
}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[Warning] This PR is generated by AI
PR Title: Fix for Heap-Buffer-Overflow Vulnerability in PcapPlusPlus - OSV-2024-947
PR Description:
pcpp::SomeIpSdLayer::getEntries()when attempting to create newSomeIpSdEntryobjects without properly checking if sufficient memory is available in the buffer. This leads to access beyond the allocated memory, causing a heap-buffer-overflow.getEntriesfunction to ensure the remaining buffer length is adequate before creating a newSomeIpSdEntryobject. If the length is insufficient, the loop terminates, preventing out-of-bounds access. This fix enhances the program's security and stability by preventing invalid memory access.Sanitizer Report Summary: The AddressSanitizer report identified a heap-buffer-overflow when the program attempted to access 1 byte beyond a 66-byte allocated buffer. The issue occurs in
pcpp::SomeIpSdEntry::SomeIpSdEntryand is triggered via thepcpp::SomeIpSdLayer::getEntries()function. The root cause is the lack of a bounds check before creating a newSomeIpSdEntryobject.Full Sanitizer Report:
Files Modified:
Packet++/src/SomeIpSdLayer.cppPatch Validation: The patch has been validated using the provided PoC, and the heap-buffer-overflow vulnerability has been resolved. No new issues have been introduced.
Links: