[GSD-14018] AR decoder: integer overflow in readDecimal bypasses bounds check

Abierto
  • ¿Algo no está bien?
#1,042 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 4 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
cpp
Área
security

Línea de trabajo

Start with readDecimal in shared/source/device_binary_format/ar/ar_decoder.h, where non-digit characters wrap the uint64_t accumulator, then follow its caller in decodeAr, where fileSize + offset is compared against binary.size(). Trace how the resulting ArrayRef reaches unpackSingleDeviceBinary. Done means non-digit input is rejected and the size-plus-offset addition is overflow-checked, with a unit test covering a malformed AR member header.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Problem

readDecimal in shared/source/device_binary_format/ar/ar_decoder.h (line 36) computes a file-size value without validating that input characters are digits:

template <uint32_t maxLength>
inline uint64_t readDecimal(const char *decimalAsString) {
    uint64_t ret = 0U;
    for (uint32_t i = 0; i < maxLength; ++i) {
        if (('\\0' == decimalAsString[i]) || (' ' == decimalAsString[i])) {
            break;
        }
        ret = ret * 10 + (decimalAsString[i] - '0');
    }
    return ret;
}

Characters below '0' (e.g. '/', '!') produce a negative value in the (c - '0') subtraction. Since ret is uint64_t, this wraps to a value near 2^64.

The caller in decodeAr uses this as a file size:

uint64_t fileSize = readDecimal<...>(entry->fileSizeInBytes);
if (fileSize + offset > binary.size()) { ... } // overflow: wraps to small value, check passes

The sum fileSize + offset overflows back to a small value, the bounds check passes, and an ArrayRef is constructed with size() ~ 2^64. This oversized span is passed to unpackSingleDeviceBinary, giving an OOB read at attacker-controlled extent.

Impact

Out-of-bounds read or crash. Reachable through clCreateProgramWithBinary when the binary is an AR archive (multi-device fat binary format). The attacker controls the AR member headers.

Suggested fix

  1. Validate that each character in readDecimal is in the range '0'-'9'. Return an error or 0 on non-digit input.
  2. Use checked arithmetic for fileSize + offset to detect overflow before the comparison.

Found by BrightSec automated security scanning.

Lenguaje dominante
C++
Estrellas
1.5k
Forks
306
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de intel/compute-runtime

Todos los issues de intel/compute-runtime

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.