Integer overflow in delta_signature_deserialize allocation #114

New Issue

2026-07-21T16:20:40+02:00

TapTap commented

2026-07-21 16:20:40 +02:00

Description

In delta_signature_deserialize(), sig->block_count comes from the network. The allocation malloc(sig->block_count * sizeof(DeltaBlockSig)) at delta.c:111 can overflow if block_count is large enough (e.g., > 536M on 64-bit), leading to a small allocation but subsequent out-of-bounds writes.

Location

src/shared/delta.c:111

How to trigger

Send a crafted delta signature with a very large block_count field. The multiplication overflows, causing a small allocation. Subsequent writes in the loop write past the buffer.

Suggested Fix

Add overflow check before allocation:

if (sig->block_count > SIZE_MAX / sizeof(DeltaBlockSig)) {
    free(sig);
    return NULL;
}

Severity

high

Sub-Agent

security-screener (SC-3)

This issue was automatically generated by the issue-creator agent.

## Description In `delta_signature_deserialize()`, `sig->block_count` comes from the network. The allocation `malloc(sig->block_count * sizeof(DeltaBlockSig))` at delta.c:111 can overflow if `block_count` is large enough (e.g., > 536M on 64-bit), leading to a small allocation but subsequent out-of-bounds writes. ## Location src/shared/delta.c:111 ## How to trigger Send a crafted delta signature with a very large `block_count` field. The multiplication overflows, causing a small allocation. Subsequent writes in the loop write past the buffer. ## Suggested Fix Add overflow check before allocation: ``` if (sig->block_count > SIZE_MAX / sizeof(DeltaBlockSig)) { free(sig); return NULL; } ``` ## Severity high ## Category security ## Sub-Agent security-screener (SC-3) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:13 +02:00

TapTap commented

2026-07-29 18:27:31 +02:00