search

gaukas / clienthellod

TLS ClientHello/QUIC Initial Packet reflection service
https://client.tlsfingerprint.io
Apache License 2.0
15 stars 2 forks source link

bug: out-of-bound access may crash the process #8

Closed gaukas closed 1 year ago

gaukas commented 1 year ago

Problem

DecodeQUICHeaderAndFrames() crashed unexpectedly on line github.com/gaukas/clienthellod@v0.3.3/quic_header.go:119

Reason

There are out-of-bound access of slices in the program which crashes the Go program once caught by Golang.

Full Log ``` Jul 09 04:15:56 REDACTED caddy[26582]: panic: runtime error: slice bounds out of range [:20] with capacity 4 Jul 09 04:15:56 REDACTED caddy[26582]: goroutine 15 [running]: Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod.DecodeQUICHeaderAndFrames({0xc000033808, 0x4b0, 0x7f8}) Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod@v0.3.3/quic_header.go:119 +0xcd7 Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod.ParseQUICCIP({0xc000033808, 0x4b0, 0x7f8}) Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod@v0.3.3/quic_client_initial_packet.go:27 +0x45 Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod/modcaddy/listener.(*ListenerWrapper).udpLoop(0xc000b7e2d0) Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod@v0.3.3/modcaddy/listener/listener.go:121 +0xfc Jul 09 04:15:56 REDACTED caddy[26582]: created by github.com/gaukas/clienthellod/modcaddy/listener.(*ListenerWrapper).Provision Jul 09 04:15:56 REDACTED caddy[26582]: github.com/gaukas/clienthellod@v0.3.3/modcaddy/listener/listener.go:81 +0x2ac Jul 09 04:15:56 REDACTED systemd[1]: caddy.service: Main process exited, code=exited, status=2/INVALIDARGUMENT Jul 09 04:15:56 REDACTED systemd[1]: caddy.service: Failed with result 'exit-code'. ```
gaukas commented 1 year ago

Fixed in #10