Array Index Underflow--http rpc
High
Vulnerability Details
## Summary:
parserse_base_utils.h:197
const unsigned char tmp = isx[(int)*++it];
Int type will cause the array subscript to appear negative and read wrong data,
Solution:
const unsigned char tmp = isx[(unsigned char)*++it];
## Releases Affected:
* up to date version on github
## Steps To Reproduce:
[add details for how we can reproduce the issue]
\#include <iostream>
\#include "serialization/keyvalue_serialization.h"
\#include "storages/portable_storage_template_helper.h"
\#include "storages/portable_storage_base.h"
\#ifdef __cplusplus
extern "C"
\#endif
int LLVMFuzzerTestOneInput(const char *data, size_t size) {
std::string s(data,size);
try
{
epee::serialization::portable_storage ps;
ps.load_from_json(s);
}
catch (const std::exception &e)
{
std::cerr << "Failed to load from binary: " << e.what() << std::endl;
return 1;
}
return 0;
}
## Supporting Material/References:
* seed file attached
## Impact
1.crash
2.leaking of sensitive info
Actions
View on HackerOneReport Stats
- Report ID: 825091
- State: Closed
- Substate: resolved
- Upvotes: 14