Summary

This patch addresses multiple high-severity buffer overflow vulnerabilities in zthin-parts/zthin/src/smapiUtilities.c that could allow remote attackers to cause denial of service or potentially execute arbitrary code.

Vulnerability Details

CVE Information

• Severity: HIGH
• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-121: Stack-based Buffer Overflow
• CWE-787: Out-of-bounds Write

Affected Function

vmbkendMain() - UDP packet handler for directory change notifications

Vulnerability Locations

1. Lines 1542, 1554: Unchecked network input lengths used with strncpy()
2. Lines 1575, 1578: Unsafe strcpy() operations
3. Lines 1599, 1600: Buffer overflow in message structure copying

Technical Analysis

Vulnerability #1: Unchecked Network Input (Lines 1542, 1554)

Original Code:

useridLength = ntohl(*(int *) &readBuffer);
strncpy(userID, readBuffer + 4, useridLength);  // No validation!

cmdLength = ntohl(*(int *) (readBuffer + 4 + useridLength));
strncpy(cmd, readBuffer + 4 + useridLength + 4, cmdLength);  // No validation!

Problem:

• useridLength and cmdLength are read directly from network packets (untrusted source)
• No validation that these values are within acceptable bounds
• userID[256] and cmd[256] buffers can be overflowed
• Missing null termination after strncpy()

Attack Scenario:

Attacker sends UDP packet:
  [useridLength: 0xFFFFFFFF] [data...]
  
Result:
  strncpy() attempts to copy 4,294,967,295 bytes
  Stack corruption occurs
  Potential for remote code execution

Fix:

// Validate userid length
if (useridLength >= sizeof(userID)) {
    // Log error and reject packet
    continue;
}
strncpy(userID, readBuffer + 4, useridLength);
userID[useridLength] = '\0';  // Ensure null termination

Vulnerability #2: Unsafe Buffer Copy (Lines 1568-1580)

Original Code:

char cacheUserID[8 + 1];  // Only 9 bytes!

for (x = 0; x < useridLength; ++x) {
    cacheUserID[x] = tolower(userID[x]);  // Can overflow if useridLength > 8
}

strcpy(cacheFile, cacheUserID);  // No bounds checking
strcat(cacheFile, ".image");     // No bounds checking

Problem:

• cacheUserID is only 9 bytes but loop can write up to 256 bytes
• strcpy() and strcat() have no bounds checking
• Stack corruption if useridLength > 8

Fix:

size_t copyLen = useridLength;
if (copyLen > sizeof(cacheUserID) - 1) {
    copyLen = sizeof(cacheUserID) - 1;  // Truncate safely
}

for (x = 0; x < copyLen; ++x) {
    cacheUserID[x] = tolower(userID[x]);
}
cacheUserID[copyLen] = '\0';

snprintf(cacheFile, sizeof(cacheFile), "%s.image", cacheUserID);

Vulnerability #3: Message Structure Overflow (Lines 1599-1600)

Original Code:

typedef struct dirChngMsgStruct {
    char userid[8 + 1];      // 9 bytes
    char userWord[16 + 1];   // 17 bytes
} dir_chng_message_struct;

strcpy(msgDirChng.userid, userID);    // userID is 256 bytes!
strcpy(msgDirChng.userWord, cmd);     // cmd is 256 bytes!

Problem:

• Copying 256-byte buffers into 9-byte and 17-byte fields
• Guaranteed overflow if source strings are longer than destination
• Corrupts adjacent memory in structure

Fix:

strncpy(msgDirChng.userid, userID, sizeof(msgDirChng.userid) - 1);
msgDirChng.userid[sizeof(msgDirChng.userid) - 1] = '\0';

strncpy(msgDirChng.userWord, cmd, sizeof(msgDirChng.userWord) - 1);
msgDirChng.userWord[sizeof(msgDirChng.userWord) - 1] = '\0';

Backward Compatibility

API Changes

• None - All changes are internal implementation fixes
• Function signatures unchanged
• External behavior unchanged for valid inputs

Behavior Changes

• Malformed packets: Now rejected instead of processed
• Oversized userids: Truncated to 8 characters for cache operations
• Invalid lengths: Logged and packet skipped

References

Standards & Guidelines

• CWE-120: Buffer Copy without Checking Size of Input
• CWE-121: Stack-based Buffer Overflow
• CWE-787: Out-of-bounds Write
• CERT C Coding Standard: STR31-C, ARR38-C
• OWASP: A1:2021 - Broken Access Control

Patch Information

Files Modified

• zthin-parts/zthin/src/smapiUtilities.c (Lines 1536-1610)

Lines Changed

• Added: ~80 lines (validation, comments, fixes)
• Modified: ~15 lines (replaced unsafe functions)
• Removed: 0 lines