olliiiver / sml_parser

Low memory C++ library to parse Smart Message Language (SML) data from smart meters.
GNU Lesser General Public License v2.1
34 stars 15 forks source link

possible overflow bugs #24

Open harryreps opened 1 year ago

harryreps commented 1 year ago

https://github.com/olliiiver/sml_parser/blob/ca76a0ac017601731d57d1078d0c92e730043d13/src/sml.cpp#L90-L93

Suppose currentLevel = MAX_TREE_SIZE - 1 at Line 90. Then, currentLevel = MAX_TREE_SIZE at Line 92, which leads to the following overflow bug.

==269918==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000f11e4a at pc 0x000000558309 bp 0x7ffde1d4abf0 sp 0x7ffde1d4abe8
WRITE of size 1 at 0x000000f11e4a thread T0
    #0 0x558308 in smlNewList(unsigned char) /home/parallels/sml_parser/src/sml.cpp:92:23
    #1 0x558637 in checkMagicByte(unsigned char&) /home/parallels/sml_parser/src/sml.cpp:118:5
    #2 0x559c52 in smlState(unsigned char&) /home/parallels/sml_parser/src/sml.cpp:292:5
harryreps commented 1 year ago

https://github.com/olliiiver/sml_parser/blob/ca76a0ac017601731d57d1078d0c92e730043d13/src/sml.cpp#L366-L369

i+y in the code above may overrun the global buffer listBuffer, leading the following bug

==271680==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000f11dd0 at pc 0x00000055a750 bp 0x7fff25f2b3b0 sp 0x7fff25f2b3a8
READ of size 1 at 0x000000f11dd0 thread T0
    #0 0x55a74f in smlOBISByUnit(long long&, signed char&, sml_units_t) /home/parallels/sml_parser/src/sml.cpp:368:28
    #1 0x55a979 in smlOBISWh(double&) /home/parallels/sml_parser/src/sml.cpp:378:3
harryreps commented 1 year ago

https://github.com/olliiiver/sml_parser/blob/ca76a0ac017601731d57d1078d0c92e730043d13/src/sml.cpp#L303-L318

i+1 and size+1 at Lines 313 and 314 may overrun the buffer and lead to the following bug:

==272722==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000f11cc6 at pc 0x000000559dcb bp 0x7ffc4eef20d0 sp 0x7ffc4eef20c8
WRITE of size 1 at 0x000000f11cc6 thread T0
    #0 0x559dca in smlOBISManufacturer(unsigned char*, int) /home/parallels/sml_parser/src/sml.cpp:314:21
    #1 0x557743 in Manufacturer() /home/parallels/sml_parser/src/main.cpp:15:23