CVE-2024-30258 (C++, published 2024-05-14T15:22Z)
Description: value: FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed `RTPS` packet, the subscriber crashes when creating `pthread`. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/eProsima/Fast-DDS
Files changed:
include/fastdds/rtps/messages/CDRMessage.h
include/fastdds/rtps/messages/CDRMessage.hpp
src/cpp/fastdds/core/policy/ParameterSerializer.hpp
test/blackbox/common/BlackboxTestsTransportUDP.cpp
Commit message: Merge pull request from GHSA-53xw-465j-rxfh

Signed-off-by: Mario Dominguez <mariodominguez@eprosima.com>

Vulnerable code:
        PropertySeq& properties);
        BinaryPropertySeq& binary_properties);
        DataHolder& data_holder);
        PropertySeq& properties)
        BinaryPropertySeq& binary_properties)
        DataHolder& data_holder)
    if (!CDRMessage::readPropertySeq(msg, data_holder.properties()))
    if (!CDRMessage::readBinaryPropertySeq(msg, data_holder.binary_properties()))
        returnedValue = CDRMessage::readDataHolder(msg, data_holders.at(i));
    bool valid =  fastrtps::rtps::CDRMessage::readDataHolder(cdr_message, parameter.token);

Fixed code:
        PropertySeq& properties,
        const uint32_t parameter_length);
        BinaryPropertySeq& binary_properties,
        const uint32_t parameter_length);
        DataHolder& data_holder,
        const uint32_t parameter_length);
        PropertySeq& properties,
        const uint32_t parameter_length)
    // Length should be at least 16 times the number of elements, since each property contains
    // 2 empty strings, each with 4 bytes for its length + at least 4 bytes of data (single NUL character + padding)
    if (16 * length > parameter_length)
    {
        return false;
    }

        BinaryPropertySeq& binary_properties,
        const uint32_t parameter_length)
    // Length should be at least 12 times the number of elements, since each each property contains at least
    // 1 empty string with 4 bytes for its length + at least 4 bytes of data (single NUL character + padding) and
    // 1 empty byte sequence with 4 bytes for its length
    if (12 * length > parameter_length)
    {
        return false;
    }

        DataHolder& data_holder,
        const uint32_t parameter_length)
    if (!CDRMessage::readPropertySeq(msg, data_holder.properties(), parameter_length))
    if (!CDRMessage::readBinaryPropertySeq(msg, data_holder.binary_properties(), parameter_length))
    // Length should be at least 16 times the number of elements, since each DataHolder contains at least
    // 1 empty string with 4 bytes for its length + at least 4 bytes of data (single NUL character + padding) and
    // 2 empty property sequences, each with 4 bytes for its length
    if (msg->pos + 16 * length > msg->length)
    {
        return false;
    }

        //! The parameter length should be the remaining length of the message
        uint32_t remaining_length = msg->length - msg->pos;
        returnedValue = CDRMessage::readDataHolder(msg, data_holders.at(i), remaining_length);
    bool valid =  fastrtps::rtps::CDRMessage::readDataHolder(cdr_message, parameter.token, parameter_length);
    DatagramInjectionTransport::deliver_datagram_from_file(receivers, "datagrams/20574.bin");
    DatagramInjectionTransport::deliver_datagram_from_file(receivers, "datagrams/20660.bin");