envoyproxy/envoy
Vedi su GitHub[kafka_broker] potential out of memory with untrusted buffer when onData()
Open
#12.687 aperta il 17 ago 2020
area/kafkahelp wanted
Metriche repository
- Star
- (27.997 star)
- Metriche merge PR
- (Merge medio 8g) (378 PR mergiate in 30 g)
Descrizione
Since documentation of kafka_broker shows it is still an alpha version, and only accept trusted data, I think this is not a security issue, so I post it here.
The ArrayDeserializer reads an integer from the buffer and uses it as the size of a new vector(variable name: required_):
https://github.com/envoyproxy/envoy/blob/master/source/extensions/filters/network/kafka/serialization.h#L466
If the input is invalid or from untrusted downstream, it's possible that the length is very large(9999999) but actually the buffer size is only 20.
We may consider adding a constraint on the vector length(for example, not more than buffer.size()?) to avoid this bug.
The issue and test case can be found here: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24862&sort=-opened&can=1&q=proj%3Aenvoy%20status%3DNew