CVE-2017-7185 (published 2017-04-10T15:59Z)

Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/cesanta/mongoose-os
commit_details: repo_url: https://github.com/cesanta/mongoose-os
author: Alexander Alashkin
author_date: 2017-04-03 10:14:16+01:00
msg: Fix crash in multipart handling

Close cesanta/dev#6974

PUBLISHED_FROM=4d4e4a46eceba10aec8dacb7f8f58bd078c92307
repository: repo_url: https://github.com/cesanta/mongoose-os
repo_name: cesanta/mongoose-os
description: Mongoose OS - an IoT Firmware Development Framework. Supported microcontrollers: ESP32, ESP8266, CC3220, CC3200, STM32F4, STM32L4, STM32F7. Amazon AWS IoT, Microsoft Azure, Google IoT Core integrated. Code in C or JavaScript.
repo_language: C
owner: cesanta
file_changes: filename: mongoose.c
change_type: ModificationType.MODIFY
diff: @@ -5961,6 +5961,12 @@ static int mg_http_multipart_wait_for_boundary(struct mg_connection *c) {
   struct mbuf *io = &c->recv_mbuf;
   struct mg_http_proto_data *pd = mg_http_get_proto_data(c);
 
+  if (pd->mp_stream.boundary == NULL) {
+    pd->mp_stream.state = MPS_FINALIZE;
+    DBG(("Invalid request: boundary not initilaized"));
+    return 0;
+  }
+
   if ((int) io->len < pd->mp_stream.boundary_len + 2) {
     return 0;
   }

programming_language: C
repo_url: https://github.com/cesanta/mongoose
commit_details: repo_url: https://github.com/cesanta/mongoose
author: Alexander Alashkin
author_date: 2017-04-03 10:14:16+01:00
msg: Fix crash in multipart handling

Close cesanta/dev#6974

PUBLISHED_FROM=4d4e4a46eceba10aec8dacb7f8f58bd078c92307
repository: repo_url: https://github.com/cesanta/mongoose
repo_name: cesanta/mongoose
description: Embedded Web Server
repo_language: C
owner: cesanta
file_changes: filename: mongoose.c
change_type: ModificationType.MODIFY
diff: @@ -5961,6 +5961,12 @@ static int mg_http_multipart_wait_for_boundary(struct mg_connection *c) {
   struct mbuf *io = &c->recv_mbuf;
   struct mg_http_proto_data *pd = mg_http_get_proto_data(c);
 
+  if (pd->mp_stream.boundary == NULL) {
+    pd->mp_stream.state = MPS_FINALIZE;
+    DBG(("Invalid request: boundary not initilaized"));
+    return 0;
+  }
+
   if ((int) io->len < pd->mp_stream.boundary_len + 2) {
     return 0;
   }

programming_language: C