Fix out of bound read in registration handling

LukasWoodtli · LukasWoodtli · commit 9a3d53b0b7c7 · 2025-11-11T10:08:52.000+01:00
In some cases the code tried to read past the registration payload.
diff --git a/core/registration.c b/core/registration.c
@@ -1606,8 +1606,7 @@ static int prv_getId(uint8_t * data,
                 }
                 // Ignore any unrecognized attribute
             }
-            if (data[limit] == REG_ATTR_SEPARATOR)
-            {
+            if (limit < length && data[limit] == REG_ATTR_SEPARATOR) {
                 limit += 1;
             }
             data += limit;
diff --git a/fuzzing/registration_handleRequest/crash_files/crash_files/crash-4722541711a0a70b31362a66129f8d3b27449b29 b/fuzzing/registration_handleRequest/crash_files/crash_files/crash-4722541711a0a70b31362a66129f8d3b27449b29
@@ -0,0 +1 @@
+</1/2/</2~.>;\FF*\F7	\A3\FF\00\00\00     ;\A3\FE
diff --git a/fuzzing/registration_handleRequest/crash_files/crash_files/crash-b609a2dd5c6a5ce4fac6b76d1fdfd2841dca4402 b/fuzzing/registration_handleRequest/crash_files/crash_files/crash-b609a2dd5c6a5ce4fac6b76d1fdfd2841dca4402
@@ -0,0 +1 @@
+</5>;<<\FF<>;\FF\FF\FF\FF\FF\FF\FF\FF\FF=\00\FF\A2cVCN

Original file line number	Diff line number	Diff line change
`@@ -1606,8 +1606,7 @@ static int prv_getId(uint8_t * data,`
`1606`	`1606`	`}`
`1607`	`1607`	`// Ignore any unrecognized attribute`
`1608`	`1608`	`}`
`1609`		`- if (data[limit] == REG_ATTR_SEPARATOR)`
`1610`		`- {`
	`1609`	`+ if (limit < length && data[limit] == REG_ATTR_SEPARATOR) {`
`1611`	`1610`	`limit += 1;`
`1612`	`1611`	`}`
`1613`	`1612`	`data += limit;`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+</1/2/</2~.>;\FF*\F7 \A3\FF\00\00\00 ;\A3\FE`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+</5>;<<\FF<>;\FF\FF\FF\FF\FF\FF\FF\FF\FF=\00\FF\A2cVCN`