search

AVL-DiTEST-DiagDev / libdoip

C/C++ library for Diagnostics over IP (DoIP)
Apache License 2.0
114 stars 66 forks source link

Null Pointer Vulnerability #11

Open Redpeppersir opened 3 days ago

Redpeppersir commented 3 days ago

In the reactOnReceivedTcpMessage method, the ROUTINGACTIVATIONREQUEST activation command dynamically allocates an array to routedClientAddress. However, when the activation command is not used and a diagnostic command (8001) is sent directly, routedClientAddress is not allocated. If it is used afterward, it causes the program to crash.

Normal activation process： image However, if the diagnostic command is sent directly, the memory address for routedClientAddress will not be dynamically allocated. image image image

image image

Redpeppersir commented 3 days ago

Hello, I understand that this is a security issue because I can directly send a DoIP command, which causes the program to crash.