Global Buffer Overflow in RTKLIB getcodepri via Unrecognized RINEX Observation Code

Vulnerability Overview Vulnerability Name: Global-Buffer-Overflow in RTKLIB via Unrecognized RINEX Observation Code #797 Vulnerability Type: Global Buffer Overflow Severity: Medium Description: In RTKLIB's function, handling an unrecognized RINEX observation code causes a global buffer overflow. Specifically, the function returns an empty string and sets when mapping an unrecognized observation code. Subsequently, the function executes , where is a negative index, resulting in reading one byte after the empty string constant. Impact Scope Affected Component: function Trigger Condition: When RTKLIB processes a RINEX file containing an unrecognized observation code Potential Impact: - May cause a crash - May read adjacent global memory, leading to information disclosure or further security issues Remediation 1. In the function, check whether and before indexing . If or , immediately return . 2. Validate observation codes when parsing RINEX files. When the function encounters an unrecognized observation code, discard the code (or log it) instead of passing it to downstream processing. 3. Audit other locations calling the function to ensure they also check that is non-zero. POC Code Environment Information Toolchain: Apple clang 12.0.0 with Target: RTKLIB - https://github.com/tomojitakasu/RTKLIB Fixed Commit: 75d0ffa9d735697c6af4d6f7f664edc6e897 (2.4.3 line, 2019-01-30) Constellation Definitions: EMGLON, EMGAL, EMGAL, EMGAL, EMGAL, EMGAL Reproduction Steps 1. Clone and checkout the fixed version: 2. Save the POC RINEX file and driver file 3. Build and run: Root Cause Analysis When mapping observation codes in the function, if the code is unrecognized, returns an empty string and sets . In the function, the index for is negative, causing a read of one byte after the empty string constant. This behavior is triggered in the function when processing the observation type list of a RINEX file; if it contains an unrecognized observation code, a global buffer overflow occurs. Detailed Behavior A carefully crafted RINEX observation file containing an unrecognized observation code will cause a crash when RTKLIB builds system signals indexes and will read adjacent global memory. This affects RINEX post-processing/visualization ( , ) and any RTKLIB pipeline that processes or downloads RINEX files. Recommended Measures 1. In the function, check whether and first. If or , immediately return . 2. Validate observation codes when parsing RINEX files. When the function encounters an unrecognized observation code, discard the code (or log it) instead of passing it to downstream processing. 3. Audit other locations calling the function to ensure they also check that is non-zero. Conclusion This vulnerability is a medium-severity global buffer overflow issue that may affect RTKLIB's stability when handling unrecognized observation codes. It is recommended to apply the aforementioned remediation measures as soon as possible to prevent potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Global Buffer Overflow in RTKLIB getcodepri via Unrecognized RINEX Observation Code

More from this source