bergzand / NanoCBOR

CBOR library aimed at heavily constrained devices
Creative Commons Zero v1.0 Universal
47 stars 23 forks source link

decoder: prevent underflow in nanocbor_leave_container() #51

Closed benpicco closed 3 years ago

benpicco commented 3 years ago

For indefinite containers remaining is 0, meaning that a call to nanocbor_leave_container() will create an underflow.

This causes nanocbor_at_end() to no longer being able to detect the end of the container.

e.g. trying to decode this message (with garbage padding bytes to trigger the issue) will attempt to decode the map past it's last element.

echo v2NzZXEBY2NtZIG/ZnJldmVydPX//3NlcQD/AAAAAAA= | base64 -d | bin/fuzztest

master

{
  "seq": 1,
  "cmd": [
    {
      "revert": True,
    },
    ,
Err
  ],
},
,
Err
Done parsing cbor

this patch

{
  "seq": 1,
  "cmd": [
    {
      "revert": True,
    },
  ],
},
,
Err
Done parsing cbor
benpicco commented 3 years ago

Why is it necessary to decrement remaining here in the first place?

NanoCBOR still fails to parse

echo v2NzZXECY2NtZIe/Y2xlZPT/v2VkZWxheRkB9P+/ZGVjaG9pSSdtIGRvbmUh/79jbGVk9f+/ZWRlbGF5GQH0/79jbGVk9P+/ZGVjaG9tTm93IEknbSBkb25lIf9jY2Zn9v8= | base64 -d | bin/fuzztest`

http://cbor.me parses the message correctly (replace bin/fuzztest with xdd -i and paste the hex array there).

Let's try this with #52