CVE-2020-26164: Uncontrolled Resource Consumption (CWE-400)
value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2020-10-07T19:15Z
Repository: https://github.com/KDE/kdeconnect-kde
Language: C++
Files changed: core/backends/lan/socketlinereader.cpp, tests/testsocketlinereader.cpp
Commit date: 2020-10-02 12:52:08 +0200
Commit message: Don't brute-force reading the socket

The package will arrive eventually, and dataReceived will be emitted.
Otherwise we just end up calling dataReceived to no end.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.

Diff: diff --git a/core/backends/lan/socketlinereader.cpp b/core/backends/lan/socketlinereader.cpp
index 11f05330..56c281ec 100644
--- a/core/backends/lan/socketlinereader.cpp
+++ b/core/backends/lan/socketlinereader.cpp
@@ -22,18 +22,10 @@ void SocketLineReader::dataReceived()
         if (line.length() > 1) { //we don't want a single \n
             m_packets.enqueue(line);
         }
     }
 
-    //If we still have things to read from the socket, call dataReceived again
-    //We do this manually because we do not trust readyRead to be emitted again
-    //So we call this method again just in case.
-    if (m_socket->bytesAvailable() > 0) {
-        QMetaObject::invokeMethod(this, "dataReceived", Qt::QueuedConnection);
-        return;
-    }
-
     //If we have any packets, tell it to the world.
     if (!m_packets.isEmpty()) {
         Q_EMIT readyRead();
     }
 }
diff --git a/tests/testsocketlinereader.cpp b/tests/testsocketlinereader.cpp
index 0e3603d2..49d15b43 100644
--- a/tests/testsocketlinereader.cpp
+++ b/tests/testsocketlinereader.cpp
@@ -11,32 +11,36 @@
 #include <QTest>
 #include <QSslSocket>
 #include <QProcess>
 #include <QEventLoop>
 #include <QTimer>
+#include <QSignalSpy>
 
 class TestSocketLineReader : public QObject
 {
     Q_OBJECT
 public Q_SLOTS:
-    void initTestCase();
+    void init();
+    void cleanup() { delete m_server; }
     void newPacket();
 
 private Q_SLOTS:
     void socketLineReader();
+    void badData();
 
 private:
     QTimer m_timer;
     QEventLoop m_loop;
     QList<QByteArray> m_packets;
     Server* m_server;
     QSslSocket* m_conn;
     SocketLineReader* m_reader;
 };
 
-void TestSocketLineReader::initTestCase()
+void TestSocketLineReader::init()
 {
+    m_packets.clear();
     m_server = new Server(this);
 
     QVERIFY2(m_server->listen(QHostAddress::LocalHost, 8694), "Failed to create local tcp server");
 
     m_timer.setInterval(4000);//For second is more enough to send some data via local socket
@@ -83,10 +87,33 @@ void TestSocketLineReader::socketLineReader()
     for(int x = 0;x < 5; ++x) {
         QCOMPARE(m_packets[x], dataToSend[x]);
     }
 }
 
+void TestSocketLineReader::badData()
+{
+    const QList<QByteArray> dataToSend = { "data1\n", "data" }; //does not end in a \n
+    for (const QByteArray& line : qAsConst(dataToSend)) {
+        m_conn->write(line);
+    }
+    m_conn->flush();
+
+    QSignalSpy spy(m_server, &QTcpServer::newConnection);
+    QVERIFY(m_server->hasPendingConnections() || spy.wait(1000));
+    QSslSocket* sock = m_server->nextPendingConnection();
+
+    QVERIFY2(sock != nullptr, "Could not open a connection to the client");
+
+    m_reader = new SocketLineReader(sock, this);
+    connect(m_reader, &SocketLineReader::readyRead, this, &TestSocketLineReader::newPacket);
+    m_timer.start();
+    m_loop.exec();
+
+    QCOMPARE(m_packets.count(), 1);
+    QCOMPARE(m_packets[0], dataToSend[0]);
+}
+
 void TestSocketLineReader::newPacket()
 {
     int maxLoops = 5;
     while(m_reader->hasPacketsAvailable() && maxLoops > 0) {
         --maxLoops;

Vulnerable code:     //If we still have things to read from the socket, call dataReceived again
    //We do this manually because we do not trust readyRead to be emitted again
    //So we call this method again just in case.
    if (m_socket->bytesAvailable() > 0) {
        QMetaObject::invokeMethod(this, "dataReceived", Qt::QueuedConnection);
        return;
    }

    void initTestCase();
void TestSocketLineReader::initTestCase()
Fixed code: #include <QSignalSpy>
    void init();
    void cleanup() { delete m_server; }
    void badData();
void TestSocketLineReader::init()
    m_packets.clear();
void TestSocketLineReader::badData()
{
    const QList<QByteArray> dataToSend = { "data1\n", "data" }; //does not end in a \n
    for (const QByteArray& line : qAsConst(dataToSend)) {
        m_conn->write(line);
    }
    m_conn->flush();

    QSignalSpy spy(m_server, &QTcpServer::newConnection);
    QVERIFY(m_server->hasPendingConnections() || spy.wait(1000));
    QSslSocket* sock = m_server->nextPendingConnection();

    QVERIFY2(sock != nullptr, "Could not open a connection to the client");

    m_reader = new SocketLineReader(sock, this);
    connect(m_reader, &SocketLineReader::readyRead, this, &TestSocketLineReader::newPacket);
    m_timer.start();
    m_loop.exec();

    QCOMPARE(m_packets.count(), 1);
    QCOMPARE(m_packets[0], dataToSend[0]);
}