[Pvfs2-developers] Buffer overflows when using protocol decode functions

[Sam Lang]

Nope, no overflow checks in PVFS.  We've seen segfaults on the server from buggy client code that has sent serialized data with encoded sizes that cause overflows.

If you were willing and motivated to modify the encoding implementation, I think you could change the encoding macros to take a pointer to a struct:

struct encoding_buffer
{
	char *buffer;
	int size;
	char *current;
};

Instead of the char **pptr.  current would allow you to keep track of where you are in the buffer as you're decoding.  This would allow you to do the proper checks as you're decoding a message to ensure you don't decode past the end of the buffer.  Might be a non-trivial change though.

-sam

On Jun 1, 2010, at 2:07 PM, Phil Carns wrote:

> Hi Nick,
> 
> There isn't anything in the server to prevent the scenario that you described, as far as I know.
> 
> -Phil
> 
> On 06/01/2010 12:57 PM, Nicholas Mills wrote:
>> Hey all,
>> 
>> Is there any code in place to prevent buffer overflows when decoding server messages (requests and responses)? In particular I'm thinking of the variable-length types like string that are prefixed with their size. It seems to me that if the size is encoded incorrectly then there is nothing to prevent the server from attempting to read past the end of the request data.
>> 
>> Buffer overflows are a concern for me because I'm using the encode/decode functions to serialize some security data. I'd like the implementation to be as robust as possible; however, if the server code itself doesn't protect against buffer overflows then there's not much point to me adding it only to my code.
>> 
>> Thanks,
>> 
>> Nick
>> 
>> _______________________________________________
>> Pvfs2-developers mailing list
>> 
>> Pvfs2-developers at beowulf-underground.org
>> http://www.beowulf-underground.org/mailman/listinfo/pvfs2-developers
>> 
>>   
>> 
> 
> _______________________________________________
> Pvfs2-developers mailing list
> Pvfs2-developers at beowulf-underground.org
> http://www.beowulf-underground.org/mailman/listinfo/pvfs2-developers