mirror of
https://github.com/mandiant/gopacket
synced 2026-06-21 13:57:02 +00:00
Jacob Paullus
d6089390bd
Four parser-panic / silent-corruption bugs in pkg/registry/hive.go, all reachable from attacker-controlled hive bytes: 1. GetValueData resident branch: VKRecord.DataLen lower 31 bits are read verbatim and used to slice a 4-byte buffer at [:dataLen]. A DataLen of 0x80000005 panics with "slice bounds out of range". Found by kajaaz using Zorya (issue #25); fix matches her suggested one-line bounds check. 2. SetValueData resident branch (structurally identical to #1): the existing len(newData) == dataLen check doesn't enforce the 4-byte cap, so a hostile dataLen=5 with a matching 5-byte newData slices one byte past the DataOffset field into the adjacent cell. Same guard. 3. SetValueData non-resident branch: vk.DataOffset is attacker- controlled and the code does copy(h.data[dataPos:dataPos+dataLen], newData) without ever validating the destination. Hostile offsets either panic on out-of-bounds or silently scribble over arbitrary hive bytes (a value of 0xFFFFF000 lands near the regf header). Route through readCell (which validates the cell header and bounds) and verify dataLen fits before mutating. 4. enumSubKeys riSig branch: readCell can return a slice shorter than the 4-byte cell header (minimum-size cell with no usable bytes), so the immediate subCell[0:2] / subCell[2:4] reads can panic on a malformed sub-list. The sibling code at line 397/437 already guards the analogous index; mirror it here. Fixes #25 plus three structurally similar bugs surfaced while patching.