envoyproxy/envoy
Voir sur GitHub[kafka_broker] potential out of memory with untrusted buffer when onData()
Open
#12 687 ouverte le 17 août 2020
area/kafkahelp wanted
Métriques du dépôt
- Stars
- (27 997 stars)
- Métriques de merge PR
- (Merge moyen 8j) (378 PRs mergées en 30 j)
Description
Since documentation of kafka_broker shows it is still an alpha version, and only accept trusted data, I think this is not a security issue, so I post it here.
The ArrayDeserializer reads an integer from the buffer and uses it as the size of a new vector(variable name: required_):
https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/kafka/serialization.h#L466
If the input is invalid or from untrusted downstream, it's possible that the length is very large(9999999) but actually the buffer size is only 20.
We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.
The issue and test case can be found here: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24862&sort=-opened&can=1&q=proj%3Aenvoy%20status%3DNew