Skip to main content

Out-of-bounds read

Need​

Prevention of out-of-bounds read vulnerabilities

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications with Servlet technology
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class VulnerableServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String data = request.getParameter("data");
        int index = Integer.parseInt(request.getParameter("index"));
        char result = data.charAt(index);
        response.getWriter().write(result);
    }
}

The vulnerable code is a servlet that reads a parameter 'data' from the HTTP request, which is a string, and an index from the same request. The servlet then tries to get a character at the specified index from the string.

The vulnerability lies in the method charAt(index). This method throws an IndexOutOfBoundsException if the index argument is negative or not less than the length of the string. This means that if a user sends an HTTP request with an index that is either negative or greater than or equal to the length of the string, the system will attempt to read data that is out of bounds of the string, which is a classic example of an out-of-bounds read vulnerability.

This vulnerability can lead to various security risks, such as information disclosure (if the system exposes the details of the exception to the user), denial of service (if the system crashes due to the exception), and potentially even code execution (if the out-of-bounds read leads to further memory corruption).

Steps​

  • Validate user input: Before using any user input, validate it to ensure it meets the expected format and range.
  • Bounds checking: Perform bounds checking to ensure that the index value is within the valid range of the data buffer.
  • Handle out-of-bounds scenarios: If the index is out of bounds, handle the scenario gracefully by returning an appropriate error message or taking necessary actions.
  • Use safe alternatives: Instead of directly accessing characters at a specific index, consider using safer alternatives like substring or character iteration to avoid out-of-bounds read vulnerabilities.
  • Follow secure coding practices: Follow secure coding practices and guidelines to minimize the risk of vulnerabilities in the code.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class SecureServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String data = request.getParameter("data");
        String indexStr = request.getParameter("index");

        // Validate user input
        if (data == null || indexStr == null) {
            response.getWriter().write("Invalid input");
            return;
        }

        int index;
        try {
            index = Integer.parseInt(indexStr);
        } catch (NumberFormatException e) {
            response.getWriter().write("Invalid index format");
            return;
        }

        // Bounds checking
        if (index < 0 || index >= data.length()) {
            response.getWriter().write("Index out of bounds");
            return;
        }

        char result = data.charAt(index);
        response.getWriter().write(result);
    }
}

The updated code includes several measures to prevent out-of-bounds read vulnerabilities:

  1. Input Validation: The code first checks if the data and indexStr parameters are not null. If either of them is null, it returns an "Invalid input" message.

  2. Index Parsing and Validation: The code then tries to parse the indexStr parameter to an integer. If the parsing fails (which means the input is not a valid integer), it returns an "Invalid index format" message.

  3. Bounds Checking: After successfully parsing the index, the code checks if the index is within the valid range of the data string (i.e., 0 &lt;= index &lt; data.length()). If the index is out of bounds, it returns an "Index out of bounds" message.

  4. Data Access: Only after all these checks does the code access the character at the specified index in the data string.

By following these steps, the code ensures that it only reads data within the valid bounds, thus preventing out-of-bounds read vulnerabilities.

References​

Last updated on