Skip to content

Bounds checking for LeaseSet2#1941

Open
chadf wants to merge 1 commit into
PurpleI2P:opensslfrom
chadf:fuzzing-1
Open

Bounds checking for LeaseSet2#1941
chadf wants to merge 1 commit into
PurpleI2P:opensslfrom
chadf:fuzzing-1

Conversation

@chadf

@chadf chadf commented Jul 5, 2023

Copy link
Copy Markdown
Contributor

This replaces pull request #1939.

@chadf

chadf commented Feb 13, 2026

Copy link
Copy Markdown
Contributor Author

Buffer overflow still in LeaseSet2 decoder:

==66929==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000048f56b at pc 0x000000ba6402 bp 0x7fffffffc3b0 sp 0x7fffffffbb68
READ of size 2 at 0x00000048f56b thread T0
    #0 0x000000ba6401 in __asan_memcpy /usr/src/contrib/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3
    #1 0x000000c42053 in buf16toh(void const*) /XXXX/i2pd/libi2pd/I2PEndian.h:96:2
    #2 0x000000c02b7a in bufbe16toh(void const*) /XXXX/i2pd/libi2pd/I2PEndian.h:116:9
    #3 0x000000c04d93 in i2p::data::LeaseSet2::ReadStandardLS2TypeSpecificPart(unsigned char const*, unsigned long, std::__1::shared_ptr<i2p::data::LocalDestination>) /XXXX/i2pd/libi2pd/LeaseSet.cpp:402:28
    #4 0x000000bff5af in i2p::data::LeaseSet2::ReadFromBuffer(unsigned char const*, unsigned long, std::__1::shared_ptr<i2p::data::LocalDestination>, bool, bool) /XXXX/i2pd/libi2pd/LeaseSet.cpp:355:9
    #5 0x000000bf9964 in i2p::data::LeaseSet2::LeaseSet2(unsigned char, unsigned char const*, unsigned long, bool, std::__1::shared_ptr<i2p::data::LocalDestination>, unsigned short) /XXXX/i2pd/libi2pd/LeaseSet.cpp:292:4
    #6 0x000000bdfa51 in main /XXXX/i2pd/fuzzing/LeaseSet2_crasher.cpp:64:2
    #7 0x000802630e33 in __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:7
    #8 0x000000b37323 in _start /usr/src/lib/csu/amd64/crt1_s.S:80

0x00000048f56b is located 0 bytes after global variable 'main::input' defined in '/XXXX/i2pd/fuzzing/LeaseSet2_crasher.cpp:8' (0x00000048f3e0) of size 395
SUMMARY: AddressSanitizer: global-buffer-overflow /XXXX/i2pd/libi2pd/I2PEndian.h:96:2 in buf16toh(void const*)


Standalone crasher code:

#include <LeaseSet.h>


int
main()
{
        static const uint8_t input[] =
        {
                      0xfb, 0x30, 0x99, 0x35, 0x89, 0x60, 0x61,
                0xf2, 0x01, 0x00, 0xf6, 0x00, 0x5c, 0xab, 0x7c,
                0xa0, 0x06, 0x58, 0xf1, 0x52, 0x97, 0xf5, 0x3b,
                0x20, 0xce, 0xc9, 0x42, 0x3f, 0xe7, 0x20, 0x9b,
                0x03, 0xfb, 0x30, 0x99, 0x35, 0x89, 0x60, 0x61,
                0xf2, 0x5f, 0x6a, 0x04, 0xad, 0x5c, 0xab, 0x7c,
                0xa0, 0x06, 0x58, 0xf1, 0x52, 0x97, 0xf5, 0x3b,
                0x20, 0xce, 0xc9, 0x42, 0x3f, 0xe7, 0x20, 0x9b,
                0x03, 0xfb, 0x30, 0x99, 0x35, 0x89, 0x60, 0x61,
                0xf2, 0x5f, 0x6a, 0x04, 0xad, 0x5c, 0xab, 0x7c,
                0xa0, 0x06, 0x11, 0xa4, 0xed, 0x12, 0x32, 0x6e,
                0x20, 0x61, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
                0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
                0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
                0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01,
                0x00, 0x9e, 0xab, 0x7c, 0xa0, 0x06, 0x11, 0xa4,
                0xed, 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00,
                0x01, 0x83, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                0xff, 0xff, 0xfb, 0x82, 0x80, 0x80, 0x80, 0x80,
                0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80,
                0x80, 0x05, 0x07, 0x2a, 0x00, 0x83, 0x01, 0x83,
                0xff, 0x9f, 0x00, 0x22, 0x9f, 0x57, 0x4f, 0x30,
                0x96, 0xe0, 0x32, 0x0a, 0xff, 0xff, 0xff, 0xff,
                0xff, 0xff, 0x00, 0x96, 0x52, 0x24, 0xb9, 0x2a,
                0x71, 0xf8, 0x7e, 0x15, 0x06, 0x02, 0xc4, 0x5f,
                0xd6, 0xbc, 0x3b, 0x1a, 0x4a, 0x22, 0xdb, 0x58,
                0x50, 0x44, 0x52, 0xc4, 0x6f, 0x45, 0x22, 0xac,
                0x4c, 0x58, 0x3e, 0x63, 0xca, 0xf6, 0x37, 0xfb,
                0x58, 0xe6, 0x06, 0xf8, 0x3c, 0xdb, 0x58, 0x7f,
                0xc8, 0x41, 0x5e, 0x6f, 0x74, 0x06, 0x99, 0xa4,
                0xf1, 0x5b, 0x06, 0xf3, 0x61, 0xb9, 0x73, 0x50,
                0xb1, 0xfa, 0x75, 0x7b, 0x44, 0x40, 0x63, 0x2a,
                0xff, 0x18, 0xd3, 0x17, 0x13, 0x23, 0x68, 0x55,
                0x8d, 0x09, 0x9d, 0x52, 0x40, 0xc9, 0x8b, 0x32,
                0x3a, 0x6b, 0x54, 0x84, 0x5e, 0x9a, 0xbc, 0x0e,
                0x15, 0x72, 0x7c, 0x86, 0xa6, 0x04, 0xb8, 0xc8,
                0x50, 0x9e, 0x80, 0x64, 0xe7, 0xa5, 0x6f, 0x37,
                0xd3, 0x62, 0xc8, 0xc8, 0x4e, 0x2b, 0xd4, 0x59,
                0x35, 0x1e, 0x0e, 0x22, 0x41, 0xd1, 0xa8, 0x80,
                0xd0, 0x6c, 0xcd, 0x8c, 0x8b, 0x35, 0xbc, 0xe9,
                0xe2, 0x1a, 0x4d, 0x55, 0xd2, 0xc5, 0xda, 0x7c,
                0x39, 0x7f, 0xae, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x8a, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x98,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea,
                0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea,
                0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea,
                0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea,
                0xea, 0xea, 0xea, 0xea,
        };

        uint8_t storeType = 0x03;

        i2p::data::LeaseSet2(storeType, input, sizeof(input), false);
}

@chadf

chadf commented Feb 13, 2026

Copy link
Copy Markdown
Contributor Author

Updated the branch to be mergeable and removed HandleDatabaseSearchReplyMsg() bound check [for now].

@chadf chadf changed the title Bounds checking and related changes. Bounds checking for LeaseSet2 Feb 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant