qTox SettingsSerializer: Unbounded Allocation & Integer Overflow in Deserialization

Vulnerability Summary: Unbounded Allocation and Integer Overflow in SettingsSerializer readStream() (#706) Vulnerability Overview The function in has two related defects when deserializing qTox settings files: 1. Signed Integer Overflow/Undefined Behavior: When reaches 28 and the byte value is 6 (i.e., ), the expression causes signed integer overflow, which is undefined behavior under the C++ standard. This may lead the compiler to optimize away subsequent checks, resulting in unpredictable control flow. 2. Unbounded Allocation: The loop lacks an upper-bound check on or the accumulated value. A maliciously crafted settings file can encode a huge value, causing to attempt allocating excessive memory (e.g., bytes), triggering an OOM crash. 3. Missing Error State Check: For truncated files, after allocates the buffer, when reads more bytes, the status of is not checked, leaving uninitialized heap memory in . Scope of Impact Affected Component: The function in . Affected Versions: All versions containing the binary format deserializer. Attack Vectors: - Local: Place a maliciously crafted file in the directory. - The settings file is read at startup; unencrypted config files are deserialized via . - Trigger conditions: The file begins with qTox magic bytes ( ), followed by the binary deserializer—it is easy to construct. Impact: - Denial of Service (Crash): Unbounded leads to OOM and immediate process termination. - Potential Code Execution: If the compiler optimizes away checks due to signed overflow UB, subsequent may write to the buffer, causing a heap buffer overflow. - Information Disclosure: For truncated files, uninitialized heap data can be accessed via an under-filled . Fix The fix is applied to . Key changes include: 1. Stream State Check: Check before each read to detect early EOF or IO errors; return on failure. 2. Overflow Protection: Add a check before the shift operation, capping at 28 to prevent signed overflow and unbounded allocation. 3. Post-Loop Validity Check: Add a check for after the loop to reject zero values or EOF states. 4. Include : Add the header file for the macro used in overflow protection. POC Code The POC is located at , which generates a minimal settings file: starting with qTox magic bytes, followed by a Vint-encoded . Placing the file in and launching qTox causes unpatched code to crash with OOM; patched code gracefully rejects the file. Related Log Output

Goal Reached Thanks to every supporter — we hit 100%!

qTox SettingsSerializer: Unbounded Allocation & Integer Overflow in Deserialization

More from this source