Repository navigation
Fix buffer overflows when parsing seed and node_ip from a config file - #133
Merged
fnordspace merged 1 commit intoOct 15, 2026
Merged
Conversation
The `-conf` config parser copied fixed-length data into heap buffers without leaving room for a null terminator or bounding the copy, so three memory-safety bugs were reachable from a config file (all confirmed with AddressSanitizer): 1. seed: `malloc(55); memset(0,55); memcpy(.., 55)` filled all 55 bytes with no terminator, so `sanityCheckSeed()`'s `strlen(g_seed)` read past the allocation (heap-buffer-overflow, READ of size 56). Relates to qubic#13. 2. seed: the same `memcpy(.., 55)` read 55 bytes from the config value even when it was shorter, over-reading the source string. 3. node_ip: `memcpy(g_nodeIp, v[1].c_str(), v[1].size())` into a 64-byte buffer with no bound, so a value longer than 64 chars overflowed it (heap-buffer-overflow, WRITE). Fixes: - seed: allocate 56 bytes (55 + terminator) and copy at most the value's own length (capped at 55), so strlen() stops in-bounds and short values are not over-read. - node_ip: cap the copy at 63 bytes so the 64th stays a terminator, and guard the trailing-newline check against an empty value. The existing `-seed`/`-nodeip` command-line paths were already safe (they point g_seed/g_nodeIp at null-terminated argv), as is the msvault vault-name parser, which already bounds its copy; this brings the config path in line.
This was referenced Oct 7, 2026
fnordspace
approved these changes
Oct 15, 2026
fnordspace
left a comment
Contributor
There was a problem hiding this comment.
LGTM, Thank you for submitting the fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
-confconfig-file parser inargparser.hcopies fixed-length data intoheap buffers without room for a null terminator or a bound on the copy length.
Three memory-safety bugs are reachable from a config file, all confirmed with
AddressSanitizer in isolated reproductions:
malloc(55); memset(0,55); memcpy(…,55)fills all 55 bytes with no terminator.
sanityCheckSeed()then callsstrlen(g_seed)(sanity_check.h) which reads past the allocation —heap-buffer-overflow, READ of size 56.memcpy(…, 55)reads 55 bytes from theconfig value even when it is shorter, over-reading the source string.
memcpy(g_nodeIp, v[1].c_str(), v[1].size())into a 64-byte buffer with no bound — a
node_ipvalue longer than 64 charsoverflows it (
heap-buffer-overflow, WRITE).Fix
value's own length (capped at 55).
strlen()now stops in-bounds and shortvalues are not over-read.
guard the trailing-newline check against an empty value.
The command-line
-seed/-nodeippaths were already safe (they point atnull-terminated
argv), and the msvault vault-name parser already bounds itscopy with
if (len > 32) len = 32;— this brings the config path in line.Verification
main; the patched logiceliminates all three (seed
strlenin-bounds for 10/55/60-char values;node_ip capped for 100-char values; no source over-read).
g++ -std=c++17 -fsyntax-only argparser.hpasses.Related to #13 (the seed null-termination report there is still present in the
config path; #13's other two reports — the
printSystemInfoFromNodehex and thegetNodeIpListpeer loop — are already resolved on currentmain).