Snap7 v1.4.3 TS7Worker::PerformFunctionWrite() Heap Buffer Overflow in WriteVar Request

Vulnerability Overview In Snap7 version 1.4.3, the function contains a heap buffer overflow vulnerability when processing malformed requests. This vulnerability occurs during the parsing of write data items and is triggered via an external TCP server path, independent of any in-process self-feed mechanism. Impact Scope Affected Version: v1.4.3 Environment: - OS: Ubuntu 24.04 LTS - Build: AddressSanitizer-enabled debug build - Target: Snap7 server built from the official 1.4.3 repository Actual Behavior When the Snap7 server is compiled with AddressSanitizer and run, processing a malformed request results in a heap buffer overflow error. Compilation Command ```bash afl-clang-fast++ -g -O0 -std=c++11 -g -O1 -fno-omit-frame-pointer -I../release/wrappers/c++ -I../src/core -I../src/sys -I../src/core/s7 -I../src/core/s7/s7_server.cpp -I../src/core/s7/s7_server.h -I../src/core/s7/s7_server_types.h -I../src/core/s7/s7_server_constants.h -I../src/core/s7/s7_server_functions.h -I../src/core/s7/s7_server_messages.h -I../src/core/s7/s7_server_requests.h -I../src/core/s7/s7_server_responses.h -I../src/core/s7/s7_server_errors.h -I../src/core/s7/s7_server_globals.h -I../src/core/s7/s7_server_protos.h -I../src/core/s7/s7_server_macros.h -I../src/core/s7/s7_server_inlines.h -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_server_inline.h -I../src/core/s7/s7_server_inline.cpp -I../src/core/s7/s7_s

Goal Reached Thanks to every supporter — we hit 100%!

Snap7 v1.4.3 TS7Worker::PerformFunctionWrite() Heap Buffer Overflow in WriteVar Request

More from this source