search

FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
774 stars 65 forks source link

Don't touch cookie list if there are no cookies #130

Closed Boolean263 closed 1 week ago

Boolean263 commented 1 week ago

In the event that there are no cookies at all, cause create_sorted_cookies() to return early. Prevents null pointer reference.

Boolean263 commented 3 days ago

That's not strictly correct. The boolean ja4h_data.cookie gets set to true if the field "http.cookie" exists, and the list ja4h_data.sorted_cookies gets populated if the field "http.cookie_pair" exists. The two are not guaranteed to both be true: Traffic with a bad cookie will cause "http.cookie" to exist but "http.cookie_pair" to remain empty, in which case create_sorted_cookies() will seg fault.

The actual traffic which caused me to find this crash is confidential, but I've doctored a sample to trigger the bug. The attached pcap contains a single packet from a larger capture from the Wireshark wiki, which has been hand-edited to not have any '=' characters in the cookie. Without this patch, Wireshark seg faults when it reads the file.

Attachment: http_bad_cookie.zip

Boolean263 commented 3 days ago

(I realize now my original description of the change was misleading. My apologies for that.)