tree ed76467703fbe9221023e61d51dd117e1e45deca
parent 9cbe4ae6b03ae4ac2a678861101a9d771a6522ce
author Petteri Aimonen <jpa@git.mail.kapsi.fi> 1616226304 +0200
committer Petteri Aimonen <jpa@git.mail.kapsi.fi> 1616226304 +0200

Fix invalid free() with oneof (#647)

Nanopb would call free() or realloc() on an invalid
(attacker controlled) pointer value when all the following
conditions are true:

- PB_ENABLE_MALLOC is defined at the compile time
- Message definition contains an oneof field, and the oneof
  contains at least one pointer type field and at least one
  non-pointer type field.
- Data being decoded first contains a non-pointer value for
  the oneof field, and later contains an overwriting pointer
  value.

Depending on message layout, the bug may not be exploitable in all
cases, but it is known to be exploitable at least with string and
bytes fields. Actual security impact will also depend on the heap
implementation used.