alanxz / rabbitmq-c

43%

master: 15%

LAST BUILD ON BRANCH cve

branch: cve

CHANGE BRANCH

x

Reset

• cve
• master
• pr443
• format
• ossl-init
• rm-amqps-examples
• cov-fixes
• ossl-v110
• pr472
• ssl-bio-enable
• pr482
• alanxz-patch-1
• pr487
• pr498
• pr496
• v090-release
• v0.9.0
• v0.9.0-master
• issue523
• issue513
• pr516
• trusty
• v091-release
• v0.10.0
• issue586
• fix588
• pr590
• win32_unused
• pr605
• pr607
• bug557
• pr556
• fix_travis
• fix_621
• fix_621_take2
• pr628
• gh-actions
• gitignore

lib: check frame_size is >= INT32_MAX

When parsing a frame header, validate that the frame_size is less than
or equal to INT32_MAX. Given frame_max is limited between 0 and
INT32_MAX in amqp_login and friends, this does not change the API.

This prevents a potential buffer overflow when a malicious client sends
a frame_size that is close to UINT32_MAX, in which causes an overflow
when computing state->target_size resulting in a small value there. A
buffer is then allocated with the small amount, then memcopy copies the
frame_size writing to memory beyond the end of the buffer.