From 91376d61347dc7aeb4ba7afcd06fb38fa9ef848f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20L=C3=A9caille?= Date: Sat, 11 Feb 2023 20:24:42 +0100 Subject: [PATCH] BUG/MEDIUM: quic: Buffer overflow when looking through QUIC CLI keyword list This has been detected by libasan as follows: ================================================================= ==3170559==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55cf77faad08 at pc 0x55cf77a87370 bp 0x7ffc01bdba70 sp 0x7ffc01bdba68 READ of size 8 at 0x55cf77faad08 thread T0 #0 0x55cf77a8736f in cli_find_kw src/cli.c:335 #1 0x55cf77a8a9bb in cli_parse_request src/cli.c:792 #2 0x55cf77a8c385 in cli_io_handler src/cli.c:1024 #3 0x55cf77d19ca1 in task_run_applet src/applet.c:245 #4 0x55cf77c0b6ba in run_tasks_from_lists src/task.c:634 #5 0x55cf77c0cf16 in process_runnable_tasks src/task.c:861 #6 0x55cf77b48425 in run_poll_loop src/haproxy.c:2934 #7 0x55cf77b491cf in run_thread_poll_loop src/haproxy.c:3127 #8 0x55cf77b4bef2 in main src/haproxy.c:3783 #9 0x7fb8b0693d09 in __libc_start_main ../csu/libc-start.c:308 #10 0x55cf7764f4c9 in _start (/home/flecaille/src/haproxy-untouched/haproxy+0x1914c9) 0x55cf77faad08 is located 0 bytes to the right of global variable 'cli_kws' defined in 'src/quic_conn.c:7834:27' (0x55cf77faaca0) of size 104 SUMMARY: AddressSanitizer: global-buffer-overflow src/cli.c:335 in cli_find_kw Shadow bytes around the buggy address: According to cli_find_kw() code and cli_kw_list struct definition, the second member of this structure ->kw[] must be a null-terminated array. Add a last element with default initializers to global variable which is impacted by this bug. This bug arrived with this commit: 15c74702d MINOR: quic: implement a basic "show quic" CLI handler Must be backported to 2.7 where this previous commit has been already backported. --- src/quic_conn.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/quic_conn.c b/src/quic_conn.c index bf272c14f..bf0581cfc 100644 --- a/src/quic_conn.c +++ b/src/quic_conn.c @@ -7833,6 +7833,7 @@ static void cli_release_show_quic(struct appctx *appctx) static struct cli_kw_list cli_kws = {{ }, { { { "show", "quic", NULL }, "show quic : display quic connections status", cli_parse_show_quic, cli_io_handler_dump_quic, cli_release_show_quic }, + {{},} }}; INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);