Integer Overflow in MPack Library

Executive Summary

This is an integer overflow vulnerability in MPack 1.1.1 affecting mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc(). When a MessagePack string length is set to the maximum 32-bit value (0xFFFFFFFF), adding 1 causes it to wrap to 0 due to unsigned arithmetic. This leads to a tiny buffer allocation but a memcpy attempt to copy ~4 GB of data, causing a heap-buffer-overflow.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for heap-buffer-overflow errors during MessagePack parsing. Use tools like AddressSanitizer (ASan) with a custom parser or application using MPack 1.1.1. Test with malicious payloads containing a str32 header declaring a ~4 GB string. Check for crashes or memory corruption when calling mpack_node_cstr_alloc or mpack_node_utf8_cstr_alloc with large maxlen values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption, crashes, or arbitrary code execution if exploited. Attackers could trigger it by sending maliciously crafted MessagePack data, potentially causing denial-of-service or data breaches depending on the application's use of MPack.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to heap-buffer-overflows, potentially causing memory corruption or crashes. Such issues may violate data integrity and security requirements in GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule on integrity and availability of ePHI). Exploits could result in unauthorized data access or modification, undermining compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of MPack if available. If not, apply overflow checks in mpack_node_cstr_alloc and mpack_node_utf8_cstr_alloc by computing allocation sizes in size_t domain with explicit overflow checks. Limit node lengths during parsing and audit all callers of these functions to enforce proper bounds. Temporarily disable parsing of untrusted MessagePack data if possible.

Useful 0 Not Useful 0