Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[BUG] system/vncviewer: `rfb_negotiate_security` never bounds the server-supplied security-type count against `sizeof(types)`, overflowing the 16-byte stack array `types[16]` (pre-auth stack buffer overflow)

Abierto Apto para principiantes
  • ¿Algo no está bien?
#3,942 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@Swatantra-66 ya está trabajando en esto.

Desde el 30/10/2026.

  • #3949 de @Swatantra-66 — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
c
Área
networking

Línea de trabajo

Empieza por system/vncviewer/rfb_protocol.c, especialmente por rfb_negotiate_security() y rfb_recv_exact(), para seguir cómo se usa la cantidad proporcionada por el servidor como longitud de lectura. Comprueba cómo rfb_discard_exact() maneja los bytes sobrantes. Rechaza una cantidad demasiado grande o consúmela de forma segura sin escribir más allá de types[16]; el trabajo estará terminado cuando las cantidades demasiado grandes no puedan desbordar el búfer y los handshakes válidos sigan funcionando.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Type: Bug
Description / Steps to reproduce the issue

During the RFB 3.7+ security handshake the server sends a one-byte count of security types,
followed by that many type bytes. rfb_negotiate_security() reads the count straight off the
socket into a uint8_t and uses it as the length of a recv into the fixed 16-byte stack array
types[16], with no upper-bound check (only the == 0 case is special-cased).

system/vncviewer/rfb_protocol.c, rfb_negotiate_security():

521 static int rfb_negotiate_security(int sockfd, const char *password)
522 {
523   uint8_t num_types;
524   uint8_t types[16];               /* 16-byte stack buffer */
...
532   ret = rfb_recv_exact(sockfd, &num_types, 1);   /* server-supplied 1..255 */
...
538   if (num_types == 0) { ... return -ECONNREFUSED; }   /* ONLY the ==0 case handled */
...
551   ret = rfb_recv_exact(sockfd, types, num_types);     /* SINK: writes num_types bytes */

rfb_recv_exact() writes exactly len bytes into the caller buffer:

383 static int rfb_recv_exact(int sockfd, void *buf, size_t len)
...
388   while (len > 0)
390       n = recv(sockfd, p, len, 0);
406       p   += n;
407       len -= n;

So line 551 can recv up to 255 bytes into types[16], a 239-byte stack overflow of
attacker-chosen content that smashes the saved-register / return-address region of the frame.
There is no bound at all (not even a DEBUGASSERT) between the 1-byte read of num_types and
its use as the copy length.

This runs before authentication: vncviewer_main.c:191 rfb_connect() →
vncviewer_main.c:208 rfb_handshake() → rfb_protocol.c:772 rfb_negotiate_security(). A
malicious VNC server (the server a viewer connects to) or an on-path attacker injecting into the
TCP stream triggers it on the first handshake, with no credentials.

Steps:

  1. Build and run the vncviewer app and connect to an attacker-controlled / MITM'd VNC server.
  2. In the RFB 3.7+ security handshake, have the server send a security-type count of e.g. 0xff
    followed by that many bytes.
  3. rfb_negotiate_security() writes those bytes past types[16].

An AddressSanitizer build reports a stack-buffer-overflow WRITE past the 16-byte types array.

Expected: a count larger than the viewer's buffer is rejected or read in capped chunks.
Actual: up to 255 attacker bytes are written past types[16] on the stack, before auth.

Suggested fix: reject or clamp num_types to sizeof(types) before the recv — the viewer
only needs to know whether None / VNC Auth is offered, so it can read in capped chunks and
discard the remainder like rfb_discard_exact already does elsewhere.

On which OS does this issue occur?

[OS: Linux]

What is the version of your OS?

ubuntu 22

NuttX Version

a09fb84a9b5f274add52cc0b6d803b77d44306c1

Issue Architecture

[Arch: all]

Issue Area

[Area: Networking]

Host information

No response

Verification
  • I have verified before submitting the report.
Lenguaje dominante
C
Estrellas
472
Forks
793
Merge medio
1 d 19 h
PR fusionados (30 d)
116

Preparar el entorno

  • Sin Dockerfile ni archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/nuttx-apps

Todos los issues de apache/nuttx-apps

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.