Vulnerability: The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow.
Vulnerability ID: CVE-2020-24074
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/kn007/silk-v3-decoder
Published: 2020-09-09
File: silk/test/Decoder.c
Commit message: Merge pull request #64 from WinMin/master

add "totBytes check, fix #62
Commit author: Karl Chen

Vulnerable version (before fix):
 int main( int argc, char* argv[] )         for( i = 0; i < MAX_LBRR_DELAY; i++ ) {             totBytes += nBytesPerPacket[ i + 1 ];         }         SKP_memmove( payload, &payload[ nBytesPerPacket[ 0 ] ], totBytes * sizeof( SKP_uint8 ) );         payloadEnd -= nBytesPerPacket[ 0 ];         SKP_memmove( nBytesPerPacket, &nBytesPerPacket[ 1 ], MAX_LBRR_DELAY * sizeof( SKP_int16 ) ); int main( int argc, char* argv[] )         for( i = 0; i < MAX_LBRR_DELAY; i++ ) {             totBytes += nBytesPerPacket[ i + 1 ];         }         SKP_memmove( payload, &payload[ nBytesPerPacket[ 0 ] ], totBytes * sizeof( SKP_uint8 ) );         payloadEnd -= nBytesPerPacket[ 0 ];         SKP_memmove( nBytesPerPacket, &nBytesPerPacket[ 1 ], MAX_LBRR_DELAY * sizeof( SKP_int16 ) );

Fixed version (after fix):
 int main( int argc, char* argv[] )         for( i = 0; i < MAX_LBRR_DELAY; i++ ) {             totBytes += nBytesPerPacket[ i + 1 ];         }         /* Check if the received totBytes is valid */         if (totBytes < 0 || totBytes > sizeof(payload))         {             fprintf( stderr, "\rPackets decoded:             %d", totPackets );             return -1;         }         SKP_memmove( payload, &payload[ nBytesPerPacket[ 0 ] ], totBytes * sizeof( SKP_uint8 ) );         payloadEnd -= nBytesPerPacket[ 0 ];         SKP_memmove( nBytesPerPacket, &nBytesPerPacket[ 1 ], MAX_LBRR_DELAY * sizeof( SKP_int16 ) ); int main( int argc, char* argv[] )         for( i = 0; i < MAX_LBRR_DELAY; i++ ) {             totBytes += nBytesPerPacket[ i + 1 ];         }          /* Check if the received totBytes is valid */         if (totBytes < 0 || totBytes > sizeof(payload))         {                          fprintf( stderr, "\rPackets decoded:              %d", totPackets );             return -1;         }                  SKP_memmove( payload, &payload[ nBytesPerPacket[ 0 ] ], totBytes * sizeof( SKP_uint8 ) );         payloadEnd -= nBytesPerPacket[ 0 ];         SKP_memmove( nBytesPerPacket, &nBytesPerPacket[ 1 ], MAX_LBRR_DELAY * sizeof( SKP_int16 ) );

Patch:
patch: @@ -361,6 +361,12 @@ int main( int argc, char* argv[] )
         for( i = 0; i < MAX_LBRR_DELAY; i++ ) {
             totBytes += nBytesPerPacket[ i + 1 ];
         }
+        /* Check if the received totBytes is valid */
+        if (totBytes < 0 || totBytes > sizeof(payload))
+        {
+            fprintf( stderr, "\rPackets decoded:             %d", totPackets );
+            return -1;
+        }
         SKP_memmove( payload, &payload[ nBytesPerPacket[ 0 ] ], totBytes * sizeof( SKP_uint8 ) );
         payloadEnd -= nBytesPerPacket[ 0 ];
         SKP_memmove( nBytesPerPacket, &nBytesPerPacket[ 1 ], MAX_LBRR_DELAY * sizeof( SKP_int16 ) );
@@ -453,6 +459,15 @@ int main( int argc, char* argv[] )
         for( i = 0; i < MAX_LBRR_DELAY; i++ ) {
             totBytes += nBytesPerPacket[ i + 1 ];
         }
+
+        /* Check if the received totBytes is valid */
+        if (totBytes < 0 || totBytes > sizeof(payload))
+        {
+            
+            fprintf( stderr, "\rPackets decoded:              %d", totPackets );
+            return -1;
+        }
+        
         SKP_memmove( payload, &payload[ nBytesPerPacket[ 0 ] ], totBytes * sizeof( SKP_uint8 ) );
         payloadEnd -= nBytesPerPacket[ 0 ];
         SKP_memmove( nBytesPerPacket, &nBytesPerPacket[ 1 ], MAX_LBRR_DELAY * sizeof( SKP_int16 ) );
path: silk/test/Decoder.c