[DPDK/other Bug 2033] pipeline: stack buffer overflow via strcat in spec parsing

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2033

            Bug ID: 2033
           Summary: pipeline: stack buffer overflow via strcat in spec
                    parsing
           Product: DPDK
           Version: 26.03
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: other
          Assignee: dev@dpdk.org
          Reporter: yangshuaisong@h-partners.com
  Target Milestone: ---

[Overview]
A stack-based buffer overflow vulnerability exists in the DPDK pipeline library
during the parsing of pipeline specification (.spec) files. The functions
`action_block_parse()` and `apply_block_parse()` in
`lib/pipeline/rte_swx_pipeline_spec.c` concatenate tokens into a fixed-size
stack buffer without checking the accumulated length, leading to a memory
corruption or crash.

[Location]
- File: lib/pipeline/rte_swx_pipeline_spec.c
- Functions: `action_block_parse()` (lines 467-471) and `apply_block_parse()`
(lines 2155-2158)
- Buffer: `char buffer[RTE_SWX_INSTRUCTION_SIZE]` (256 bytes)

[Environment & Build]
- DPDK Version: [Please enter the scanned DPDK version here, e.g., 23.11 /
24.11 / main]
- OS / Kernel: Generic / Linux
- Tool: Identified via static analysis / manual code review.

[Vulnerability Logic & Analysis]
1. The specification file parser loop (lines 2903-2952) restricts individual
token lengths to less than 64 bytes (`strnlen(token, RTE_SWX_NAME_SIZE) >=
RTE_SWX_NAME_SIZE` triggers "Token too big").
2. However, there is no upper-bound validation on the total accumulated length
of `n_tokens` within a single line. The maximum tokens per line (`MAX_TOKENS`)
is 256, and the maximum line length (`MAX_LINE_LENGTH`) is 2048.
3. In `action_block_parse()` and `apply_block_parse()`, tokens are concatenated
into a 256-byte stack buffer using unbounded `strcat`:
   ```c
   buffer = 0;
   for (i = 0; i < n_tokens; i++) {
       if (i)
           strcat(buffer, " ");
       strcat(buffer, tokens[i]);
   }
   ```
4. Mathematical Proof: If a malicious or malformed .spec file contains a line
with 5 tokens, each 63 bytes long, the total concatenated length becomes: 5 *
63 + 4 (spaces) = 319 bytes.
5. This mathematically exceeds the 255-byte capacity (256 bytes minus 1 null
terminator) of the stack buffer, leading to a definite stack buffer overflow
when processing such a file.

[Actual Results]
No runtime crash has been triggered yet, but static analysis confirms an
unvalidated path leading to a stack-based out-of-bounds write (CVE-2024-11616),
causing potential memory corruption or application crash if an oversized .spec
file is loaded.

[Expected Results]
The token concatenation should safely handle string lengths, and the parser
should reject lines whose accumulated tokens exceed `RTE_SWX_INSTRUCTION_SIZE -
1`.

[Suggested Fix]
Replace the unbounded `strcat` with bounded string operations (`strncat` or
`snprintf`) that consider the remaining space in the destination buffer, for
example:
```c
buffer = 0;
for (i = 0; i < n_tokens; i++) {
    if (i)
        strncat(buffer, " ", sizeof(buffer) - strlen(buffer) - 1);
    strncat(buffer, tokens[i], sizeof(buffer) - strlen(buffer) - 1);
}
```
Alternatively, add a pre-check validation on the total length before entering
the concatenation loop, and return an error if it exceeds the limit.

-- 
You are receiving this mail because:
You are the assignee for the bug.