From 917e985755bf79c8ab5dfec3453dfedaca48c256 Mon Sep 17 00:00:00 2001 From: Dev dev Date: Fri, 23 Oct 2026 10:25:29 +0530 Subject: [PATCH] Fixed SNMPv3 msgUserName null terminator out-of-bounds write (#434) The SNMPv3 USM parser copies msgUserName into nx_snmp_agent_v3_security_user_name using _nx_snmp_utility_octet_get with sizeof(...) as the bound, and appends a null terminator at the returned size index. Because the array is 64 bytes (NX_SNMP_MAX_USER_NAME), a 64-byte user name writes a null terminator at index 64, which is one byte past the array. In NX_SNMP_AGENT, nx_snmp_agent_v3_security_user_name_size immediately follows nx_snmp_agent_v3_security_user_name with no padding. On little-endian architectures, writing 0 to index 64 clears the low byte of the size field, corrupting the length from 64 to 0 and causing the agent to handle the request as an empty-username discovery packet. _nx_snmp_utility_octet_get is now passed sizeof(...) - 1 at the call site, reserving room for the null terminator. Names exceeding 63 bytes are rejected as invalid packets, while valid names up to 63 bytes remain within bounds. Signed-off-by: Dev dev --- addons/snmp/nxd_snmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/snmp/nxd_snmp.c b/addons/snmp/nxd_snmp.c index f0ed29998..08f5c6f3d 100644 --- a/addons/snmp/nxd_snmp.c +++ b/addons/snmp/nxd_snmp.c @@ -17528,7 +17528,7 @@ INT buffer_length; /* Get the security username */ /********************************************************/ length = _nx_snmp_utility_octet_get(buffer_ptr, agent_ptr -> nx_snmp_agent_v3_security_user_name, - sizeof(agent_ptr -> nx_snmp_agent_v3_security_user_name), &(agent_ptr -> nx_snmp_agent_v3_security_user_name_size), buffer_length); + sizeof(agent_ptr -> nx_snmp_agent_v3_security_user_name) - 1, &(agent_ptr -> nx_snmp_agent_v3_security_user_name_size), buffer_length); #ifdef NX_SNMPV3_PRINT_DEBUG_MESSAGE NX_SNMPV3_DBG_PRINTF("Security name parsed: %s Size: %d\n\r", &agent_ptr -> nx_snmp_agent_v3_security_user_name[0], agent_ptr -> nx_snmp_agent_v3_security_user_name_size);