Heap Out-of-Bounds Write in libconfini

Executive Summary

libconfini 1.16.4 has a heap out-of-bounds write in the strip_ini_cache() function. The function writes a null terminator one byte past the allocated buffer when processing non-empty INI input, causing heap memory corruption. This happens because the bundled utility allocates exactly ini_length bytes instead of the required ini_length + 1 bytes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can use tools like AddressSanitizer (ASan) or Valgrind to monitor heap memory corruption. Compile the application using libconfini 1.16.4 with ASan enabled and run it against non-empty INI input files. If heap-buffer-overflow errors are reported, the vulnerability is likely present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by corrupting heap memory. It may also lead to other security issues depending on the application's use of the libconfini library. The impact is deterministic for any non-empty input processed by vulnerable applications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libconfini to a patched version where the bundled utility allocates ini_length + 1 bytes. If an update is unavailable, modify the application to allocate an extra byte for the null terminator. Additionally, add input validation to ensure ini_length does not exceed buffer size.

Useful 0 Not Useful 0