tree 4dc4fca70d23b11e4909bec7a93b8c86582f725b
parent 400192533089725ba6977408d0222d884f2c83f6
author Juraj Vijtiuk <juraj.vijtiuk@sartura.hr> 1622025734 +0200
committer Michal Vasko <mvasko@cesnet.cz> 1622092672 +0200

parser yang BUGFIX parsing revisions longer than LY_REV_SIZE

Change date_len argument type to size_t in lysp_check_date,
instead of uint8_t.

This bug was found by OSS-Fuzz in lys_parse_mem.

The issue would appear when a revision longer than LY_REV_SIZE was
in the input model. get_argument() would parse the string and return
a length that is significantly bigger than LY_REV_SIZE.
The word_len was then cast into a uint8_t, and since word_len is a
size_t an overflow would occur, where only the first 10 characters of
the string would be read, resulting in the date appearing as valid in
lysp_check_date(). The strncpy() into rev->date would then result in an
overflow, as word_len bytes are copied.

Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>