Skip to content

Uncapped memory allocation in NBT parser #395

Description

@mrKisp

Fuzzing Environment and Configuration

OS: Ubuntu Linux 22.04 LTS
minutor: v 26.1 commit
AFL++ (American Fuzzy Lop Plus Plus) Standard Fuzzing (explore mode)
Ran fuzzer for about 24 hours to get the following results

The Problem

Upon fuzzing Minutor with a seed mca file (superflat for efficiency) as also done in #394 with the addition of try/catch wraps in our harness script, the fuzzer was able to trigger huge allocation requests and the NBT parser blindly trusts the integers provide in the binary file. A maliciously created mca file can end up consuming all the system's memory and can even lock up a user's operating system (Denial of Service). This could potentially get weaponized by someone sharing one such corrupted mca file to trigger a DOS on a victim client running minutor with a corrupted file (we were able to recreate this on our own machine on accident upon attempting to open one such corrupted file).

The Solution

To fix this, there needs to be sanity checks to make sure the memory allocation is valid.

AFL Details

AFL Harness (with error try/catches to account for error handling issue)

harness.cpp

AFL Output

deep_bugs_report.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions