Headline
CVE-2023-27772: SEGV in function ControlObjectClient_setOrigin() · Issue #442 · mz-automation/libiec61850
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.
Hi, team
There is a SEGV in function ControlObjectClient_setOrigin in src/iec61850/client/client_control.c:328 when called from libiec61850/examples/iec61850_client_example_control/client_example_control.c:60.
Steps to reproduce:
I used gcc 9.4 and AddressSanitizer(export CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address"before make examples) to build libiec61850.
First, I run the server_example_simple in directory libiec61850/examples/server_example_simple by command sudo ./server_example_simple so that the server is set up.
Then I tested client_example_control in directory libiec61850/examples/iec61850_client_example_control by command sudo ./client_example_control.
But I got SEGV in function ControlObjectClient_setOrigin in src/iec61850/client/client_control.c:328.
$ sudo ./client_example_control
AddressSanitizer:DEADLYSIGNAL
=================================================================
==12824==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000078 (pc 0x5638e2e178dc bp 0x7ffe9101eb20 sp 0x7ffe9101eb00 T0)
==12824==The signal is caused by a READ memory access.
==12824==Hint: address points to the zero page.
#0 0x5638e2e178db in ControlObjectClient_setOrigin src/iec61850/client/client_control.c:328
#1 0x5638e2e06190 in main /home/saltf1sh/target/libiec61850/examples/iec61850_client_example_control/client_example_control.c:60
#2 0x7fc4901b70b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
#3 0x5638e2e05dbd in _start (/home/saltf1sh/target/libiec61850/examples/iec61850_client_example_control/client_example_control+0x26dbd)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/iec61850/client/client_control.c:328 in ControlObjectClient_setOrigin
==12824==ABORTING