CVE-2024-25110 (C, published 2024-02-12T20:15Z)
Description: value: The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Azure/azure-uamqp-c
Files changed:
src/message.c
Commit message: Use safe math in message.c (#452)



Vulnerable code:
                size_t i;
                result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, (source_message->body_amqp_data_count * sizeof(BODY_AMQP_DATA)));
                if (result->body_amqp_data_items == NULL)
                    /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                    LogError("Cannot allocate memory for body data sections");
                    message_destroy(result);
                    for (i = 0; i < source_message->body_amqp_data_count; i++)
                        result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;
                        /* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
                        result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
                        if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
                            LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
                            break;
                        else
                            (void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);

                    result->body_amqp_data_count = i;
                    if (i < source_message->body_amqp_data_count)
                    {
                        /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                        message_destroy(result);
                        result = NULL;
                    }
                size_t i;
                result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, (source_message->body_amqp_sequence_count * sizeof(AMQP_VALUE)));
                if (result->body_amqp_sequence_items == NULL)
                    /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                    LogError("Cannot allocate memory for body AMQP sequences");
                    for (i = 0; i < source_message->body_amqp_sequence_count; i++)
                    {
                        /* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
                        result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
                        if (result->body_amqp_sequence_items[i] == NULL)
                        {
                            LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
                            break;
                        }
                    }

                    result->body_amqp_sequence_count = i;
                    if (i < source_message->body_amqp_sequence_count)
                }
            /* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
            BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, sizeof(BODY_AMQP_DATA) * (message->body_amqp_data_count + 1));
            if (new_body_amqp_data_items == NULL)
                /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                LogError("Cannot allocate memory for body AMQP data items");
                message->body_amqp_data_items = new_body_amqp_data_items;

                if (amqp_data.length == 0)
                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
                    message->body_amqp_data_count++;

                    /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
                    result = 0;
                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
                    if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
                    {
                        /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                        LogError("Cannot allocate memory for body AMQP data to be added");
                        result = MU_FAILURE;
                    }
                    else
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
                        (void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
            AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, sizeof(AMQP_VALUE) * (message->body_amqp_sequence_count + 1));
            if (new_body_amqp_sequence_items == NULL)
                /* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                LogError("Cannot allocate enough memory for sequence items");
                message->body_amqp_sequence_items = new_body_amqp_sequence_items;
                /* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
                /* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
                message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
                if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
                    /* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                    LogError("Cloning sequence failed");
                    /* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
                    message->body_amqp_sequence_count++;
                    /* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
                    result = 0;

Fixed code:
#include "azure_c_shared_utility/safe_math.h"
                size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_data_count, sizeof(BODY_AMQP_DATA));
                if (calloc_size == SIZE_MAX)
                    LogError("Invalid size for body_amqp_data_items");
                    result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, calloc_size);

                    if (result->body_amqp_data_items == NULL)
                        /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                        LogError("Cannot allocate memory for body data sections");
                        message_destroy(result);
                        result = NULL;
                    }
                    else
                    {
                        size_t i;
                        for (i = 0; i < source_message->body_amqp_data_count; i++)
                            result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;

                            /* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
                            result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
                            if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
                            {
                                LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
                                break;
                            }
                            else
                            {
                                (void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);
                            }

                        result->body_amqp_data_count = i;
                        if (i < source_message->body_amqp_data_count)
                            /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                            message_destroy(result);
                            result = NULL;
                size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_sequence_count, sizeof(AMQP_VALUE));
                if (calloc_size == SIZE_MAX)
                    LogError("Invalid size for body_amqp_sequence_items");
                    result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, calloc_size);
                    if (result->body_amqp_sequence_items == NULL)
                        LogError("Cannot allocate memory for body AMQP sequences");
                    else
                    {
                        size_t i;

                        for (i = 0; i < source_message->body_amqp_sequence_count; i++)
                        {
                            /* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
                            result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
                            if (result->body_amqp_sequence_items[i] == NULL)
                            {
                                LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
                                break;
                            }
                        }

                        result->body_amqp_sequence_count = i;
                        if (i < source_message->body_amqp_sequence_count)
                        {
                            /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                            message_destroy(result);
                            result = NULL;
                        }
                    }
				}
            size_t realloc_size = safe_add_size_t(message->body_amqp_data_count, 1);
            realloc_size = safe_multiply_size_t(sizeof(BODY_AMQP_DATA), realloc_size);

            if (realloc_size == SIZE_MAX)
                LogError("Invalid size for new_body_amqp_data_items");
                /* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
                BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, realloc_size);
                if (new_body_amqp_data_items == NULL)
                    /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                    LogError("Cannot allocate memory for body AMQP data items");
                    result = MU_FAILURE;
                    message->body_amqp_data_items = new_body_amqp_data_items;

                    if (amqp_data.length == 0)
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
                    else
                    {
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
                        if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
                        {
                            /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                            LogError("Cannot allocate memory for body AMQP data to be added");
                            result = MU_FAILURE;
                        }
                        else
                        {
                            message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
                            (void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
                            message->body_amqp_data_count++;

                            /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
                            result = 0;
                        }
                    }
            size_t realloc_size = safe_add_size_t(message->body_amqp_sequence_count, 1);
            realloc_size = safe_multiply_size_t(sizeof(AMQP_VALUE), realloc_size);

            if (realloc_size == SIZE_MAX)
                LogError("Invalid size for new_body_amqp_sequence_items");
                AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, realloc_size);
                if (new_body_amqp_sequence_items == NULL)
                    /* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                    LogError("Cannot allocate enough memory for sequence items");
                    message->body_amqp_sequence_items = new_body_amqp_sequence_items;
                    /* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
                    /* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
                    message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
                    if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
                    {
                        /* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                        LogError("Cloning sequence failed");
                        result = MU_FAILURE;
                    }
                    else
                    {
                        /* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
                        message->body_amqp_sequence_count++;

                        /* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
                        result = 0;
                    }