CVE-2017-1000494: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2018-01-03T14:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpc/upnpreplyparse.c, miniupnpd/upnpreplyparse.c
Commit date: 2017-12-11 14:27:27 +0100
Commit message: properly initialize data structure for SOAP parsing in ParseNameValue()

topelt field was not properly initialized.

should fix #268

Diff: diff --git a/miniupnpc/upnpreplyparse.c b/miniupnpc/upnpreplyparse.c
index 5de5796a..ae84b0ba 100644
--- a/miniupnpc/upnpreplyparse.c
+++ b/miniupnpc/upnpreplyparse.c
@@ -1,9 +1,10 @@
 /* $Id: upnpreplyparse.c,v 1.19 2015/07/15 10:29:11 nanard Exp $ */
-/* MiniUPnP project
+/* vim: tabstop=4 shiftwidth=4 noexpandtab
+ * MiniUPnP project
  * http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/
- * (c) 2006-2015 Thomas Bernard
+ * (c) 2006-2017 Thomas Bernard
  * This software is subject to the conditions detailed
  * in the LICENCE file provided within the distribution */
 
 #include <stdlib.h>
 #include <string.h>
@@ -102,13 +103,11 @@ NameValueParserGetData(void * d, const char * datas, int l)
 void
 ParseNameValue(const char * buffer, int bufsize,
                struct NameValueParserData * data)
 {
 	struct xmlparser parser;
-	data->l_head = NULL;
-	data->portListing = NULL;
-	data->portListingLength = 0;
+	memset(data, 0, sizeof(struct NameValueParserData));
 	/* init xmlparser object */
 	parser.xmlstart = buffer;
 	parser.xmlsize = bufsize;
 	parser.data = data;
 	parser.starteltfunc = NameValueParserStartElt;
diff --git a/miniupnpd/upnpreplyparse.c b/miniupnpd/upnpreplyparse.c
index 5de5796a..ae84b0ba 100644
--- a/miniupnpd/upnpreplyparse.c
+++ b/miniupnpd/upnpreplyparse.c
@@ -1,9 +1,10 @@
 /* $Id: upnpreplyparse.c,v 1.19 2015/07/15 10:29:11 nanard Exp $ */
-/* MiniUPnP project
+/* vim: tabstop=4 shiftwidth=4 noexpandtab
+ * MiniUPnP project
  * http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/
- * (c) 2006-2015 Thomas Bernard
+ * (c) 2006-2017 Thomas Bernard
  * This software is subject to the conditions detailed
  * in the LICENCE file provided within the distribution */
 
 #include <stdlib.h>
 #include <string.h>
@@ -102,13 +103,11 @@ NameValueParserGetData(void * d, const char * datas, int l)
 void
 ParseNameValue(const char * buffer, int bufsize,
                struct NameValueParserData * data)
 {
 	struct xmlparser parser;
-	data->l_head = NULL;
-	data->portListing = NULL;
-	data->portListingLength = 0;
+	memset(data, 0, sizeof(struct NameValueParserData));
 	/* init xmlparser object */
 	parser.xmlstart = buffer;
 	parser.xmlsize = bufsize;
 	parser.data = data;
 	parser.starteltfunc = NameValueParserStartElt;

Vulnerable code: /* MiniUPnP project
 * (c) 2006-2015 Thomas Bernard
	data->l_head = NULL;
	data->portListing = NULL;
	data->portListingLength = 0;
/* MiniUPnP project
 * (c) 2006-2015 Thomas Bernard
	data->l_head = NULL;
	data->portListing = NULL;
	data->portListingLength = 0;
Fixed code: /* vim: tabstop=4 shiftwidth=4 noexpandtab
 * MiniUPnP project
 * (c) 2006-2017 Thomas Bernard
	memset(data, 0, sizeof(struct NameValueParserData));
/* vim: tabstop=4 shiftwidth=4 noexpandtab
 * MiniUPnP project
 * (c) 2006-2017 Thomas Bernard
	memset(data, 0, sizeof(struct NameValueParserData));