Fuzzing Environment and Configuration
OS: Ubuntu Linux 22.04 LTS
minutor: v 26.1 commit
AFL++ (American Fuzzy Lop Plus Plus) Standard Fuzzing (explore mode)
Ran fuzzer for about 24 hours to get the following results
The Problem
Upon fuzzing Minutor with a seed mca file (superflat for efficiency) as also done in #394 with the addition of try/catch wraps in our harness script, the fuzzer was able to trigger huge allocation requests and the NBT parser blindly trusts the integers provide in the binary file. A maliciously created mca file can end up consuming all the system's memory and can even lock up a user's operating system (Denial of Service). This could potentially get weaponized by someone sharing one such corrupted mca file to trigger a DOS on a victim client running minutor with a corrupted file (we were able to recreate this on our own machine on accident upon attempting to open one such corrupted file).
The Solution
To fix this, there needs to be sanity checks to make sure the memory allocation is valid.
AFL Details
AFL Harness (with error try/catches to account for error handling issue)
harness.cpp
AFL Output
deep_bugs_report.txt
Fuzzing Environment and Configuration
OS: Ubuntu Linux 22.04 LTS
minutor: v 26.1 commit
AFL++ (American Fuzzy Lop Plus Plus) Standard Fuzzing (explore mode)
Ran fuzzer for about 24 hours to get the following results
The Problem
Upon fuzzing Minutor with a seed mca file (superflat for efficiency) as also done in #394 with the addition of try/catch wraps in our harness script, the fuzzer was able to trigger huge allocation requests and the NBT parser blindly trusts the integers provide in the binary file. A maliciously created mca file can end up consuming all the system's memory and can even lock up a user's operating system (Denial of Service). This could potentially get weaponized by someone sharing one such corrupted mca file to trigger a DOS on a victim client running minutor with a corrupted file (we were able to recreate this on our own machine on accident upon attempting to open one such corrupted file).
The Solution
To fix this, there needs to be sanity checks to make sure the memory allocation is valid.
AFL Details
AFL Harness (with error try/catches to account for error handling issue)
harness.cpp
AFL Output
deep_bugs_report.txt