pipeline: stack buffer overflow via strcat in spec parsing

https://bugs.dpdk.org/show_bug.cgi?id=2033

            Bug ID: 2033
           Summary: pipeline: stack buffer overflow via strcat in spec
                    parsing
           Product: DPDK
           Version: 26.03
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: other
          Assignee: [email protected]
          Reporter: [email protected]

Target Milestone: ---

[Overview]
A stack-based buffer overflow vulnerability exists in the DPDK pipeline library during the parsing of pipeline specification (.spec) files. The functions action_block_parse() and apply_block_parse() in lib/pipeline/rte_swx_pipeline_spec.c concatenate tokens into a fixed-size stack buffer without checking the accumulated length, leading to a memory corruption or crash.

[Location]
- File: lib/pipeline/rte_swx_pipeline_spec.c
- Functions: action_block_parse() (lines 467-471) and apply_block_parse() (lines 2155-2158)
- Buffer: char buffer[RTE_SWX_INSTRUCTION_SIZE] (256 bytes)

[Environment & Build]
- DPDK Version: [Please enter the scanned DPDK version here, e.g., 23.11 / 24.11 / main]
- OS / Kernel: Generic / Linux
- Tool: Identified via static analysis / manual code review.

[Vulnerability Logic & Analysis]
1. The specification file parser loop (lines 2903-2952) restricts individual token lengths to less than 64 bytes (strnlen(token, RTE_SWX_NAME_SIZE) >= RTE_SWX_NAME_SIZE triggers "Token too big").
2. However, there is no upper-bound validation on the total accumulated length of n_tokens within a single line. The maximum tokens per line (MAX_TOKENS) is 256, and the maximum line length (MAX_LINE_LENGTH) is 2048.
3. In action_block_parse() and apply_block_parse(), tokens are concatenated into a 256-byte stack buffer using unbounded strcat:

   ```c
   buffer = 0;
   for (i = 0; i < n_tokens; i++) {
       if (i)
           strcat(buffer, " ");
       strcat(buffer, tokens[i]);
   }
   ```

4. Mathematical Proof: If a malicious or malformed .spec file contains a line with 5 tokens, each 63 bytes long, the total concatenated length becomes: 5 * 63 + 4 (spaces) = 319 bytes.
5. This mathematically exceeds the 255-byte capacity (256 bytes minus 1 null terminator) of the stack buffer, leading to a definite stack buffer overflow when processing such a file.

[Actual Results]
No runtime crash has been triggered yet, but static analysis confirms an unvalidated path leading to a stack-based out-of-bounds write (CVE-2024-11616), causing potential memory corruption or application crash if an oversized .spec file is loaded.

[Expected Results]
The token concatenation should safely handle string lengths, and the parser should reject lines whose accumulated tokens exceed RTE_SWX_INSTRUCTION_SIZE - 1.

[Suggested Fix]
Replace the unbounded strcat with bounded string operations (strncat or snprintf) that consider the remaining space in the destination buffer, for example:

```c
buffer = 0;
for (i = 0; i < n_tokens; i++) {
    if (i)
        strncat(buffer, " ", sizeof(buffer) - strlen(buffer) - 1);
    strncat(buffer, tokens[i], sizeof(buffer) - strlen(buffer) - 1);
}
```

Alternatively, add a pre-check validation on the total length before entering the concatenation loop, and return an error if it exceeds the limit.

You are receiving this mail because:
You are the assignee for the bug.