Loading HuntDB...

Array Index Underflow--http rpc

High
M
Monero
Submitted None
Reported by minerscan

Vulnerability Details

Technical details and impact analysis

Array Index Underflow
## Summary: parserse_base_utils.h:197 const unsigned char tmp = isx[(int)*++it]; Int type will cause the array subscript to appear negative and read wrong data, Solution: const unsigned char tmp = isx[(unsigned char)*++it]; ## Releases Affected: * up to date version on github ## Steps To Reproduce: [add details for how we can reproduce the issue] \#include <iostream> \#include "serialization/keyvalue_serialization.h" \#include "storages/portable_storage_template_helper.h" \#include "storages/portable_storage_base.h" \#ifdef __cplusplus extern "C" \#endif int LLVMFuzzerTestOneInput(const char *data, size_t size) { std::string s(data,size); try { epee::serialization::portable_storage ps; ps.load_from_json(s); } catch (const std::exception &e) { std::cerr << "Failed to load from binary: " << e.what() << std::endl; return 1; } return 0; } ## Supporting Material/References: * seed file attached ## Impact 1.crash 2.leaking of sensitive info

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Array Index Underflow