Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed crash on assert in parse_cred_mgmt_subcommandparams() #558

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

DanielCohenHillel
Copy link

There was no check that the map value was actually a byte string, this makes it
possible to pass invalid input into cbor_value_copy_byte_string() function from
tinycbor. There is an assertion to check the type of the input, and it is possible
to make it fail.

Here is an example payload that would make the assertion fail:

\x41\x41\x41\x41\x90\x00\x10\x41\xa1\x02\xa1\x01\x62\x58\x58

Payload structure explenation:

  • CID: "AAAA"
  • CMD: CTAPHID_CBOR (0x90)
  • BCNT: 16
  • SUBCMD: CTAP_CBOR_CRED_MGMT_PRE (0x41)
    • MAP {
      • CM_subCommandParams MAP {
        • CM_subCommandRpId = "XX" // <== regular string, not byte string
          }
          }

There was no check that the map value was actually a byte string, this makes it
possible to pass invalid input into cbor_value_copy_byte_string() function from
tinycbor. There is an assert to check the type of the input, and it is possible
to make it fail.

Here is an example payload that would make the assertion fail:

 \x41\x41\x41\x41\x90\x00\x10\x41\xa1\x02\xa1\x01\x62\x58\x58

Payload structure explenation:
  * CID: "AAAA"
  * CMD: CTAPHID_CBOR (0x90)
  * BCNT: 16
  * SUBCMD: CTAP_CBOR_CRED_MGMT_PRE (0x41)
     * MAP {
        * CM_subCommandParams MAP {
           * CM_subCommandRpId = "XX"     // <== regular string, not byte string
        }
     }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant