[PROTON-976] pn_read_frame does not validate frame offset

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: proton-0.10
• Fix Version/s: proton-0.10
• Component/s: proton-c
• Assignee: Ken Giusti
• Reporter: Ken Giusti
• Created: 06/Aug/15 12:24
• Updated: 07/Jan/16 12:14
• Resolved: 07/Aug/15 12:44

Description

pn_read_frame in framing.c does not validate the doff with respect to the frame size. If doff is corrupt proton will still attempt to parse the frame. This can result in a crash.

I consider this a blocker as an attacker can craft a bad frame that results in crashing the receiver.

Issue Links

• duplicates: PROTON-109 Proton should handle inbound max-frame size violations.
• relates to: PROTON-975 connecting with DIGEST-MD5 fails if buffer containing outcome and first encrypted frame is received