envoyproxy/envoy

[kafka_broker] potential out of memory with untrusted buffer when onData()

Open

#12,687 opened on Aug 17, 2020

View on GitHub
 (2 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/kafkahelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Since documentation of kafka_broker shows it is still an alpha version, and only accept trusted data, I think this is not a security issue, so I post it here.

The ArrayDeserializer reads an integer from the buffer and uses it as the size of a new vector(variable name: required_): https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/kafka/serialization.h#L466

If the input is invalid or from untrusted downstream, it's possible that the length is very large(9999999) but actually the buffer size is only 20.

We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.

The issue and test case can be found here: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24862&sort=-opened&can=1&q=proj%3Aenvoy%20status%3DNew

Contributor guide

Research direction
Examine the ArrayDeserializer in serialization.h and add a size constraint, e.g., ensure the vector length does not exceed buffer size.
Tech stack
None
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitC++
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75