alanxz / rabbitmq-c

43%

master: 15%

LAST BUILD ON BRANCH cve

branch: cve

CHANGE BRANCH

x

Reset

• cve
• alanxz-patch-1
• bug557
• cov-fixes
• fix588
• fix_621
• fix_621_take2
• fix_travis
• format
• gh-actions
• gitignore
• issue513
• issue523
• issue586
• master
• ossl-init
• ossl-v110
• pr443
• pr472
• pr482
• pr487
• pr496
• pr498
• pr516
• pr556
• pr590
• pr605
• pr607
• pr628
• rm-amqps-examples
• ssl-bio-enable
• trusty
• v0.10.0
• v0.9.0
• v0.9.0-master
• v090-release
• v091-release
• win32_unused

lib: check frame_size is >= INT32_MAX

When parsing a frame header, validate that the frame_size is less than
or equal to INT32_MAX. Given frame_max is limited between 0 and
INT32_MAX in amqp_login and friends, this does not change the API.

This prevents a potential buffer overflow when a malicious client sends
a frame_size that is close to UINT32_MAX, in which causes an overflow
when computing state->target_size resulting in a small value there. A
buffer is then allocated with the small amount, then memcopy copies the
frame_size writing to memory beyond the end of the buffer.