## Summary A **server-side heap-use-after-free** can be triggered in **S2OPC 1.7.3** when the server processes a `ModifyMonitoredItemsRequest` containing **multiple event-filter modifications for the same monitored item** and later serializes/frees the corresponding response. The attached proof-of-concept creates an event monitored item and then sends a `ModifyMonitoredItemsRequest` with **two entries targeting the same `MonitoredItemId`**: 1. an **empty `EventFilter`** 2. a **partly invalid `EventFilter`** containing one valid select clause (`Message`) and one invalid browse path (`DefinitelyNotAnEventField`) Under AddressSanitizer, the server crashes with a **heap-use-after-free** during response cleanup. The allocation stack points to `monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result()`, while the free/reuse happens later in the recursive clear path (`SOPC_ExtensionObject_Clear()` / `SOPC_Clear_Array()`) when the response message is destroyed. In practical terms, a remote client can crash the server through a normal OPC UA service path (`ModifyMonitoredItems`) by sending a crafted but protocol-valid request sequence. --- ## Version - **Affected version**: `1.7.3` - **Observed commit**: `b4c5c7d63cd69698461d514b905a7c92b3c377c4` --- ## Impact This is a **remotely reachable server-side memory safety bug** in the subscription / monitored-item service path. An authenticated OPC UA client able to create or modify subscriptions can send a crafted `ModifyMonitoredItemsRequest` and trigger: - **reliable denial of service** of the server process; - **memory corruption symptoms during response encoding / cleanup**; - a **heap-use-after-free** in a path that recursively traverses and clears encodeable OPC UA objects. The demonstrated impact is **server crash / process abort**. Because the fault happens in generic recursive cleanup code (`SOPC_ExtensionObject_Clear`, `SOPC_EncodeableObject_Clear`, `SOPC_Clear_Array`) and involves object lifetime corruption, the bug should be treated as **more serious than a simple logic error**. At minimum it is a robust remote DoS. --- ## Affected path The failing request/response path is: ```bash ModifyMonitoredItemsRequest -> subscription_mgr__treat_subscription_modify_monitored_items_req() -> subscription_mgr__fill_response_subscription_modify_monitored_items() -> subscription_core__modify_monitored_item() -> monitored_item_filter_treatment__check_monitored_item_filter_valid_and_fill_result() -> monitored_item_event_filter_treatment__init_event_filter_ctx_and_result() [allocates EventFilterResult-related object] ... response encoding / cleanup -> message_out_bs__dealloc_msg_out() -> SOPC_EncodeableObject_Delete() -> SOPC_EncodeableObject_Clear() -> SOPC_ExtensionObject_Clear() -> SOPC_Clear_Array() [use-after-free] ``` --- ## Root cause ### 1. Event filter validation allocates the object that later becomes dangling The ASan allocation site is: ```bash monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result() -> SOPC_EncodeableObject_Create() ``` This is the point where the server creates the heap object later reported as freed and reused. The public API / generated documentation for this component shows that the function explicitly returns **both**: - a monitoring filter context; and - a filter result object. That interface shape is already a warning sign for ownership mistakes: ```c void monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result( const constants__t_monitoringFilter_i p_filter, constants_statuscodes_bs__t_StatusCode_i * const p_sc, constants__t_monitoringFilterCtx_i * const p_filterCtx, constants__t_filterResult_i * const p_filterResult, t_entier4 * const p_nbSelectClauses, t_entier4 * const p_nbWhereClausesElements); ``` The same module also exposes two distinct destructors: ```c void monitored_item_event_filter_treatment_bs__delete_event_filter_context( const constants__t_monitoringFilterCtx_i p_filterCtx); void monitored_item_event_filter_treatment_bs__delete_event_filter_result( const constants__t_filterResult_i p_filterResult); ``` That split ownership model is correct **only if** the context object and the outward-facing result object never end up sharing the same heap-owned encodeable payload. ### 2. `subscription_core__modify_monitored_item()` computes a new `filterResult` and, on success, stores the new filter context into the monitored item The generated source/coverage for `subscription_core__modify_monitored_item()` shows the relevant control flow: ```c monitored_item_filter_treatment__check_monitored_item_filter_valid_and_fill_result( subscription_core__l_nid, subscription_core__l_aid, subscription_core__p_filter, constants__c_Variant_indet, subscription_core__p_sc, &subscription_core__l_filterCtx, subscription_core__p_filterResult, &subscription_core__l_isEvent); if ((subscription_core__l_isExpectedSubId == true) && (*subscription_core__p_sc == constants_statuscodes_bs__e_sc_ok)) { monitored_item_pointer_bs__modify_monitored_item_pointer( subscription_core__l_monitoredItemPointer, subscription_core__p_timestampToReturn, subscription_core__p_clientHandle, subscription_core__l_filterCtx, subscription_core__p_discardOldest, *subscription_core__p_revQueueSize, subscription_core__p_sc); } ``` This is important: - `check_monitored_item_filter_valid_and_fill_result(...)` returns **`p_filterResult`** for the service response; - on success, the code also hands **`l_filterCtx`** to `monitored_item_pointer_bs__modify_monitored_item_pointer(...)`. This strongly suggests a design where: - one object is intended to become part of the monitored item state; - another object is intended to become part of the service response. The ASan result demonstrates that the implementation does **not** preserve this ownership separation under the crafted input sequence. ### 3. The response cleanup path proves that the same object is reachable more than once from the response object graph The crash occurs while clearing the outgoing message object: ```bash message_out_bs__dealloc_msg_out() -> SOPC_EncodeableObject_Delete() -> SOPC_EncodeableObject_Clear() -> SOPC_ExtensionObject_Clear() -> SOPC_Clear_Array() ``` The same heap allocation is: 1. freed in `SOPC_ExtensionObject_Clear()`; 2. then traversed again through the recursive clear path; 3. read from `SOPC_Clear_Array()` after free. This means the response object graph contains **at least two references** to the same heap-owned encodeable object, or one object has already been cleared but remains reachable through a second `ExtensionObject`. --- ## Debugger-relevant runtime state ### Client-visible request state ```bash CreateSubscription: sub=20 CreateMonitoredItems: eventMi=1 ModifyMonitoredItems reuse trigger: sub=20 eventMi=1 items=2 ``` ### PoC request composition The PoC sets: - `req->SubscriptionId = subscriptionId` - `req->NoOfItemsToModify = 2` - both entries use `req->ItemsToModify[i].MonitoredItemId = monitoredItemId` - item 0 carries an **empty** `EventFilter` - item 1 carries a **partly invalid** `EventFilter` - clause 0: `ConditionType / Message` - clause 1: `ConditionType / DefinitelyNotAnEventField` --- ## PoC Program [PoC.zip](https://github.com/user-attachments/files/30095897/PoC.zip) --- ## Reproduction ## 1. Build S2OPC with AddressSanitizer The following build command was used for the ASan-enabled tree: ```bash env BUILD_DIR=build-asan \ S2OPC_CLIENTSERVER_ONLY=ON \ WITH_ASAN=ON \ ENABLE_TESTING=OFF \ ENABLE_SAMPLES=ON \ WARNINGS_AS_ERRORS=OFF \ ./build.sh --jobs 8 ``` ## 2. Start the server In terminal 1: ```bash cd build-asan-event/bin TEST_PASSWORD_PRIVATE_KEY=password ./toolkit_test_server events ``` ## 3. Run the PoC client In terminal 2: ```bash cd build-asan-event/bin TEST_PASSWORD_PRIVATE_KEY=password ./poc ``` ## 4. Expected client output ```bash client_initialize: status=0 connect: status=0 CreateSubscription: service=0x00000000 sub=20 create_subscription: status=0 CreateMonitoredItems: eventMi=1 create_event_monitored_item: status=0 ModifyMonitoredItems reuse trigger: sub=20 eventMi=1 items=2 modify_monitored_items_reuse_filter_result: status=8 toolkit_test_client_modify_event_filter_result_reuse final result: NOK status=8 ``` ## 5. Expected server output / crash <details> <summary>Click for Full ASan</summary> ```bash ================================================================= ==2162523==ERROR: AddressSanitizer: heap-use-after-free on address 0x50700006c978 at pc 0x5a6ace615f4e bp 0x7931b4ffa4a0 sp 0x7931b4ffa490 READ of size 4 at 0x50700006c978 thread T5 #0 0x5a6ace615f4d in SOPC_Clear_Array /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:5234 #1 0x5a6ace61db18 in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:761 #2 0x5a6ace61db18 in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:705 #3 0x5a6ace60a965 in SOPC_ExtensionObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:3635 #4 0x5a6ace61dbda in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:784 #5 0x5a6ace61dbda in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:705 #6 0x5a6ace615eb9 in SOPC_Clear_Array /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:5242 #7 0x5a6ace615eb9 in SOPC_Clear_Array /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:5229 #8 0x5a6ace61db18 in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:761 #9 0x5a6ace61db18 in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:705 #10 0x5a6ace620e94 in SOPC_EncodeableObject_Delete /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:814 #11 0x5a6ace593989 in message_out_bs__dealloc_msg_out /home/weichuan/wc/S2OPC/src/ClientServer/services/b2c/message_out_bs.c:199 #12 0x5a6ace5569c1 in service_mgr__encode_session_service_resp /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:740 #13 0x5a6ace5591b2 in service_mgr__server_receive_session_service_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:1190 #14 0x5a6ace55072a in io_dispatch_mgr__receive_msg_buffer /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/io_dispatch_mgr.c:227 #15 0x5a6ace51b466 in onSecureChannelEvent /home/weichuan/wc/S2OPC/src/ClientServer/services/sopc_services_api.c:197 #16 0x5a6ace5f6baa in looper_loop /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_event_handler.c:108 #17 0x7931ba894ac2 in start_thread nptl/pthread_create.c:442 #18 0x7931ba9268cf (/lib/x86_64-linux-gnu/libc.so.6+0x1268cf) 0x50700006c978 is located 8 bytes inside of 80-byte region [0x50700006c970,0x50700006c9c0) freed by thread T5 here: #0 0x5a6ace463357 in free (/home/weichuan/wc/S2OPC/build-asan-event/bin/toolkit_test_server+0x52c357) #1 0x5a6ace60a8e5 in SOPC_ExtensionObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:3636 #2 0x5a6ace61dbda in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:784 #3 0x5a6ace61dbda in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:705 #4 0x5a6ace615eb9 in SOPC_Clear_Array /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:5242 #5 0x5a6ace615eb9 in SOPC_Clear_Array /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:5229 #6 0x5a6ace61db18 in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:761 #7 0x5a6ace61db18 in SOPC_EncodeableObject_Clear /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:705 #8 0x5a6ace620e94 in SOPC_EncodeableObject_Delete /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:814 #9 0x5a6ace593989 in message_out_bs__dealloc_msg_out /home/weichuan/wc/S2OPC/src/ClientServer/services/b2c/message_out_bs.c:199 #10 0x5a6ace5569c1 in service_mgr__encode_session_service_resp /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:740 #11 0x5a6ace5591b2 in service_mgr__server_receive_session_service_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:1190 #12 0x5a6ace55072a in io_dispatch_mgr__receive_msg_buffer /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/io_dispatch_mgr.c:227 #13 0x5a6ace51b466 in onSecureChannelEvent /home/weichuan/wc/S2OPC/src/ClientServer/services/sopc_services_api.c:197 #14 0x5a6ace5f6baa in looper_loop /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_event_handler.c:108 #15 0x7931ba894ac2 in start_thread nptl/pthread_create.c:442 previously allocated by thread T5 here: #0 0x5a6ace4636a7 in malloc (/home/weichuan/wc/S2OPC/build-asan-event/bin/toolkit_test_server+0x52c6a7) #1 0x5a6ace620db4 in SOPC_EncodeableObject_Create /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_encodeabletype.c:795 #2 0x5a6ace596e26 in monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result /home/weichuan/wc/S2OPC/src/ClientServer/services/b2c/monitored_item_event_filter_treatment_bs.c:549 #3 0x5a6ace5d2583 in monitored_item_event_filter_treatment__check_monitored_item_event_filter_valid /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/monitored_item_event_filter_treatment.c:83 #4 0x5a6ace5d3e97 in monitored_item_filter_treatment__check_monitored_item_filter_valid_and_fill_result /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/monitored_item_filter_treatment.c:72 #5 0x5a6ace5e5f18 in subscription_core__modify_monitored_item /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/subscription_core.c:1286 #6 0x5a6ace57ad2d in subscription_mgr__fill_response_subscription_modify_monitored_items /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/subscription_mgr.c:748 #7 0x5a6ace57e102 in subscription_mgr__treat_subscription_modify_monitored_items_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/subscription_mgr.c:1355 #8 0x5a6ace55572d in service_mgr__treat_session_nano_extended_service_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:486 #9 0x5a6ace556460 in service_mgr__treat_session_service_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:680 #10 0x5a6ace556460 in service_mgr__decode_and_treat_session_service_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:630 #11 0x5a6ace5590b7 in service_mgr__server_receive_session_service_req /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/service_mgr.c:1177 #12 0x5a6ace55072a in io_dispatch_mgr__receive_msg_buffer /home/weichuan/wc/S2OPC/src/ClientServer/services/bgenc/io_dispatch_mgr.c:227 #13 0x5a6ace51b466 in onSecureChannelEvent /home/weichuan/wc/S2OPC/src/ClientServer/services/sopc_services_api.c:197 #14 0x5a6ace5f6baa in looper_loop /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_event_handler.c:108 #15 0x7931ba894ac2 in start_thread nptl/pthread_create.c:442 Thread T5 created by T0 here: #0 0x5a6ace4074c5 in pthread_create (/home/weichuan/wc/S2OPC/build-asan-event/bin/toolkit_test_server+0x4d04c5) #1 0x5a6ace5eeaf1 in create_thread /home/weichuan/wc/S2OPC/src/Common/helpers_platform_dep/linux/p_sopc_threads.c:275 #2 0x5a6ace5eeaf1 in SOPC_Thread_Create /home/weichuan/wc/S2OPC/src/Common/helpers_platform_dep/linux/p_sopc_threads.c:336 #3 0x5a6ace5f73e2 in SOPC_Looper_Create /home/weichuan/wc/S2OPC/src/Common/helpers/sopc_event_handler.c:167 #4 0x5a6ace51d98b in SOPC_Services_Initialize /home/weichuan/wc/S2OPC/src/ClientServer/services/sopc_services_api.c:904 #5 0x5a6ace4fb233 in SOPC_Toolkit_Initialize /home/weichuan/wc/S2OPC/src/ClientServer/configuration/sopc_toolkit_config.c:141 #6 0x5a6ace4ccb83 in SOPC_CommonHelper_Initialize /home/weichuan/wc/S2OPC/src/ClientServer/frontend/common_wrapper/libs2opc_common_config.c:145 #7 0x5a6ace3cf3f2 in Server_Initialize /home/weichuan/wc/S2OPC/tests/ClientServer/validation_tests/server/toolkit_test_server.c:290 #8 0x5a6ace3cf3f2 in main /home/weichuan/wc/S2OPC/tests/ClientServer/validation_tests/server/toolkit_test_server.c:1204 #9 0x7931ba829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: heap-use-after-free /home/weichuan/wc/S2OPC/src/Common/opcua_types/sopc_builtintypes.c:5234 in SOPC_Clear_Array Shadow bytes around the buggy address: 0x0a0e800058d0: fd fd fd fd fd fa fa fa fa fa 00 00 00 00 00 00 0x0a0e800058e0: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0a0e800058f0: fd fa fa fa fa fa fd fd fd fd fd fd fd fd fd fa 0x0a0e80005900: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa 0x0a0e80005910: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa =>0x0a0e80005920: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd[fd] 0x0a0e80005930: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0a0e80005940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0a0e80005950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0a0e80005960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0a0e80005970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==2162523==ABORTING ``` </details> --- ## Proposed patch The safest place to fix this is when `subscription_mgr__fill_response_subscription_modify_monitored_items()` stores the per-item `filterResult` into `OpcUa_MonitoredItemModifyResult`. ### Patch intent - Replace any shallow assignment / aliasing of `FilterResult` with a **deep copy** using `SOPC_ExtensionObject_Copy()`. - Ensure the temporary per-item object is fully cleared after the copy. - Ensure the response slot is initialized before being populated. ### Suggested code ```c /* subscription_mgr.c */ #include "sopc_builtintypes.h" #include "sopc_mem_alloc.h" /* Helper: guarantee that each response result owns its own FilterResult payload. */ static SOPC_ReturnStatus subscription_mgr__copy_filter_result_to_modify_result( OpcUa_MonitoredItemModifyResult* dst, const SOPC_ExtensionObject* src) { SOPC_ASSERT(NULL != dst); /* Defensive reset in case the caller reuses a response slot. */ SOPC_ExtensionObject_Clear(&dst->FilterResult); SOPC_ExtensionObject_Initialize(&dst->FilterResult); if (NULL == src) { return SOPC_STATUS_OK; } return SOPC_ExtensionObject_Copy(&dst->FilterResult, src); } ``` Then, in the body of `subscription_mgr__fill_response_subscription_modify_monitored_items()`, use a **temporary** `SOPC_ExtensionObject`, and deep-copy it into the final response slot: ```c /* Example structure inside the per-item loop */ SOPC_ExtensionObject tmpFilterResult; SOPC_ExtensionObject_Initialize(&tmpFilterResult); /* constants__t_filterResult_i is effectively used here as a filter-result handle. */ constants__t_filterResult_i l_filterResult = &tmpFilterResult; /* Per-item service logic */ subscription_core__modify_monitored_item( subscription_mgr__p_subscription, l_monitoredItemId, subscription_mgr__p_tsToReturn, l_clientHandle, l_filter, l_discardOldest, l_queueSize, &l_sc, l_filterResult, &l_revSamplingItv, &l_revQueueSize); /* Populate the final OPC UA response slot */ OpcUa_MonitoredItemModifyResult_Initialize(&resp->Results[i]); resp->Results[i].StatusCode = l_statusCode; resp->Results[i].RevisedSamplingInterval = l_revSamplingItv; resp->Results[i].RevisedQueueSize = (uint32_t) l_revQueueSize; /* * CRITICAL: deep-copy the filter result into the response slot. * Never shallow-copy / alias the same ExtensionObject across results. */ SOPC_ReturnStatus cpyStatus = subscription_mgr__copy_filter_result_to_modify_result(&resp->Results[i], &tmpFilterResult); if (SOPC_STATUS_OK != cpyStatus) { resp->Results[i].StatusCode = OpcUa_BadOutOfMemory; SOPC_ExtensionObject_Clear(&resp->Results[i].FilterResult); SOPC_ExtensionObject_Initialize(&resp->Results[i].FilterResult); } /* CRITICAL: clear/reset the temporary object before the next iteration. */ SOPC_ExtensionObject_Clear(&tmpFilterResult); SOPC_ExtensionObject_Initialize(&tmpFilterResult); ``` ---