Security Vulnerability - Action Required: Integer Overflow to Buffer Overflow vulnerability may in your project

[Crispy-fried-chicken]

Hi,
we have detected that your project may be vulnerable to Integer Overflow to Buffer Overflow in the function of free_args in the file of src/util/util.c . It shares similarities to a recent CVE disclosure CVE-2024-6381 in the mongo-c-driver.

The source vulnerability information is as follows:

Vulnerability Detail:
CVE Identifier: CVE-2024-6381
Description: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-6381
Patch: mongodb/mongo-c-driver@effd95c

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!

[alexey-tikhonov]

Hi,

from your point of view, what is the issue (i.e. what are you going to fix with a PR)?

[Crispy-fried-chicken]

@alexey-tikhonov Hi, maybe I'm going to fix it by using pointer-based iteration just like the fix in mongodb/mongo-c-driver@effd95c. It may avoid overflow.

[alexey-tikhonov]

Well, the question was "what" is the issue, not "how" to fix it.

I don't think overflow of i in free_args() is a "valid" issue: args are allocated using realloc(ret, (num + 2) * sizeof(char *)); where num is int. So if overflow could happen, it would happen before.

In this sense change of iterator from int to pointer is quite cosmetic but it won't hurt either.

[Crispy-fried-chicken]

I know, but if the num is INT_MAX-2, there is no possibility that the overflow will happen? and there is no need to fix it?

[alexey-tikhonov]

I know, but if the num is INT_MAX-2, there is no possibility that the overflow will happen? and there is no need to fix it?

Sorry I didn't understand this question.

[Crispy-fried-chicken]

I mean there is no need that num is INT_MAX-2？If so, it will be overflow.