Project: open5gs (open5gs/open5gs), language: c++
Vulnerability instance: open5gs.cve-2024-40130
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/open5gs/open5gs/issues/2577
## Description:
Issue: open5gs/open5gs#2577
Title: [Bug]: Possible dynamic-stack-buffer-overflow in /lib/core/abts.c
State: closed
Created by: liuxiaoxinxinxin
Created at: 2023-09-05 07:38:00+00:00
Labels: type:bug, Type:Security

Issue Body:
### Open5GS Release, Revision, or Tag

v2.6.4

### Steps to reproduce

According to "Building Open5GS from Sources," I compiled Open5GS with ASAN on ubuntu 20.04. After the compilation was completed, I ran meson test -v in the build directory, and ASAN reported the following information:

==23232==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffc12a4a898 at pc 0x7f275967feda bp 0x7ffc12a4a530 sp 0x7ffc12a4a528
WRITE of size 8 at 0x7ffc12a4a898 thread T0
    #0 0x7f275967fed9 in abts_main /home/lxy/Downloads/open5gs-main/build/../lib/core/abts.c:592:17
    #1 0x4f3c0e in main /home/lxy/Downloads/open5gs-main/build/../tests/core/abts-main.c:85:10
    #2 0x7f2759295082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #3 0x41ebad in _start (/home/lxy/Downloads/open5gs-main/build/tests/core/core+0x41ebad)

Address 0x7ffc12a4a898 is located in stack of thread T0 at offset 856 in frame
    #0 0x7f275967f2df in abts_main /home/lxy/Downloads/open5gs-main/build/../lib/core/abts.c:506

  This frame has 2 object(s):
    [32, 136) 'options' (line 509)
    [176, 208) 'optarg' (line 510) <== Memory access at offset 856 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow /home/lxy/Downloads/open5gs-main/build/../lib/core/abts.c:592:17 in abts_main
Shadow bytes around the buggy address:
  0x1000025414c0: 00 00 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x1000025414d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000025414e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000025414f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100002541500: 00 00 00 00 00 00 00 00 00 00 00 00 ca ca ca ca
=>0x100002541510: 00 00 00[cb]cb cb cb cb f1 f1 f1 f1 00 00 00 00
  0x100002541520: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00
  0x100002541530: f2 f2 00 00 00 00 f3 f3 f3 f3 f3 f3 00 00 00 00
  0x100002541540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100002541550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100002541560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==23232==ABORTING
 1/13 open5gs:unit / core                     FAIL     0.12 s (exit status 1)

### Logs

```shell
The same issue has been identified in other test cases as well.
Here are the call hierarchies for different test cases:

tests/crypt/abts-main.c -> /lib/core/abts.c
==23234==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffdb26df1f8 at pc 0x7f85e1fabeda bp 0x7ffdb26dee90 sp 0x7ffdb26dee88
WRITE of size 8 at 0x7ffdb26df1f8 thread T0
    #0 0x7f85e1fabed9 in abts_main /home/lxy/Downloads/open5gs-main/build/../lib/core/abts.c:592:17
    #1 0x4d048e in main /home/lxy/Downloads/open5gs-main/build/../tests/crypt/abts-main.c:58:10
    #2 0x7f85e1bc1082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #3 0x41c54d in _start (/home/lxy/Downloads/open5gs-main/build/tests/crypt/crypt+0x41c54d)

/tests/sctp/abts-main.c -> /lib/core/abts.c
==23236==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffca5bd3d58 at pc 0x7f245e2eaeda bp 0x7ffca5bd39f0 sp 0x7ffca5bd39e8
WRITE of size 8 at 0x7ffca5bd3d58 thread T0
    #0 0x7f245e2eaed9 in abts_main /home/lxy/Downloads/open5gs-main/build/../lib/core/abts.c:592:17
    #1 0x4c89ce in main /home/lxy/Downloads/open5gs-main/build/../tests/sctp/abts-main.c:53:10
    #2 0x7f245dee3082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #3 0x41c4dd in _start (/home/lxy/Downloads/open5gs-main/build/tests/sctp/sctp+0x41c4dd)

/tests/unit/abts-main.c -> /lib/core/abts.c
==23238==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffe71df8cd8 at pc 0x7f2b6fc70eda bp 0x7ffe71df8970 sp 0x7ffe71df8968
WRITE of size 8 at 0x7ffe71df8cd8 thread T0
    #0 0x7f2b6fc70ed9 in abts_main /home/lxy/Downloads/open5gs-main/build/../lib/core/abts.c:592:17
    #1 0x4cae7e in main /home/lxy/Downloads/open5gs-main/build/../tests/unit/abts-main.c:75:10
    #2 0x7f2b6d46a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #3 0x41e98d in _start (/home/lxy/Downloads/open5gs-main/build/tests/unit/unit+0x41e98d)
```


### Expected behaviour

Based on the call stack analysis, I've identified that the issue occurs in
/test/core/abts-main.c line 80: const char* argv_out[argc + 2];
where the size allocated for argv_out is missing one byte. 
**The same issue has also been found in**:
/test/unit/abts-main.c line 70 
/test/sctp/abts-main.c line 48 
/test/crypt/abts-main.c line 53.
I would like to propose modifying the code to const char* argv_out[argc + 3]; to prevent further buffer overflow issues.
I am not quite sure whether this is a bug, any feedback would be appreciated! 
### Observed Behaviour

ASAN reported dynamic-stack-buffer-overflow in /lib/core/abts.c:592:17 and the test failed

### eNodeB/gNodeB

_No response_

### UE Models and versions

_No response_


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
CFLAGS="$CFLAGS -Wno-compound-token-split-by-macro -Wno-format"
CXXFLAGS="$CFLAGS"
LDFLAGS="$CFLAGS"
sed -i "s|link_args: lib_fuzzing_engine|link_args: [lib_fuzzing_engine, '-ltalloc', '-Wl,-rpath,\$ORIGIN/lib']|" tests/fuzzing/meson.build
meson setup builddir --default-library=static -Dfuzzing=true -Dlib_fuzzing_engine="$LIB_FUZZING_ENGINE"
ninja -C builddir -k 0 || true

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get upgrade -y && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends python3-pip python3-setuptools python3-wheel ninja-build build-essential flex bison git cmake meson libsctp-dev libgnutls28-dev libgcrypt-dev libssl-dev libidn11-dev libmongoc-dev libbson-dev libmicrohttpd-dev libcurl4-gnutls-dev libnghttp2-dev libtins-dev libtalloc-dev iproute2 ca-certificates netbase pkg-config && apt-get install -y autoconf libtool-bin
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends python3-pip python3-setuptools python3-wheel ninja-build build-essential flex bison git cmake meson libsctp-dev libgnutls28-dev libgcrypt-dev libssl-dev libidn11-dev libmongoc-dev libbson-dev libmicrohttpd-dev libcurl4-gnutls-dev libnghttp2-dev libtins-dev libtalloc-dev iproute2 ca-certificates netbase pkg-config && apt-get install -y autoconf libtool-bin
RUN apt-get install -y autoconf libtool-bin
RUN git clone https://github.com/open5gs/open5gs open5gs
RUN git -C open5gs checkout 78f64aaccb5dfde35c611b8bc1acec11edc79bdf
WORKDIR $SRC/open5gs
COPY build.sh $SRC/

Additional files: