search

azatoth / minidlna

MiniDLNA (aka ReadyDLNA) is server software with the aim of being fully compliant with DLNA/UPnP-AV clients. It is developed by a NETGEAR employee for the ReadyNAS product line
http://sourceforge.net/projects/minidlna/
Other
294 stars 78 forks source link

Potential Integer Overflow vulnerability in upnphttp.c #24

Open KSB21ST opened 3 years ago

KSB21ST commented 3 years ago

Hi, It seems that there exists a potential integer overflow. Please find the following description:

  1. n can be an arbitrary large number https://github.com/azatoth/minidlna/blob/eff77615abf6087c76647ed57b8878280a6cd215/upnphttp.c#L1042

  2. h->req_buflen is added to n https://github.com/azatoth/minidlna/blob/eff77615abf6087c76647ed57b8878280a6cd215/upnphttp.c#L1060

  3. Process_upnphttp(...) is called again https://github.com/azatoth/minidlna/blob/eff77615abf6087c76647ed57b8878280a6cd215/minidlna.c#L1180

  4. Call to realloc with the large integer can cause a memory allocation with an overflowed size https://github.com/azatoth/minidlna/blob/eff77615abf6087c76647ed57b8878280a6cd215/upnphttp.c#L1088