[FD] lighttpd2 Signedness Error in li_chunkqueue_append_mem() Leads to Out-of-Bounds Memory Access

[Ron E <ronaldjedgerson@xxxxxxxxx>]

*Description:*
A signedness vulnerability exists in the li_chunkqueue_append_mem()
function in lighttpd2, where a signed length parameter (gssize len) is not
properly validated before being used in memory operations that expect an
unsigned size. When a negative length value is supplied, it is implicitly
converted to a large unsigned value, resulting in an out-of-bounds memory
read and a stack buffer overflow.

*Affected Component:*

   - Project: lighttpd2
   - File: src/main/chunk.c
   - Function: li_chunkqueue_append_mem()
   - Affected versions: lighttpd2 2.0.0 (and likely earlier versions in the
   2.x series)

*Attack Vector:*

   - Local / Internal API misuse
   - Potential remote reachability if malformed HTTP request bodies,
   chunked transfer decoding, or backend responses result in negative length
   calculations that reach li_chunkqueue_append_mem().

*Technical Details:*
*The vulnerable function is defined as:*
void li_chunkqueue_append_mem(liChunkQueue *cq, const void *mem, gssize
len);
*Inside the function, len is only checked for zero:*
if (!len) return; Negative values are not rejected. When a negative gssize
value (e.g., -1) is passed, it is later used in calls that treat the value
as an unsigned size (gsize), resulting in a large length such as
4294967295. This causes unsafe memory operations via g_array_append_vals()
and ultimately memcpy(), leading to an out-of-bounds memory access.

*Proof of Concept:*
A minimal reproducer demonstrates the issue:

    /* Trigger signedness bug */
    li_chunkqueue_append_mem(cq, buf, -1);

# ./chunk

*Output:*

=================================================================
==175485==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbff9cf00028 at pc 0xaaaae7908080 bp 0xffffc50ec5a0 sp 0xffffc50ebd90
READ of size 4294967295 at 0xfbff9cf00028 thread T0
    #0 0xaaaae790807c in memcpy (/root/lighttpd2/chunk+0xd807c) (BuildId:
5f4fb5aa4dacb9c02ca0afc9864a810d23e3629a)
    #1 0xffff9fa9651c in g_array_append_vals
(/lib/aarch64-linux-gnu/libglib-2.0.so.0+0x2651c) (BuildId:
ee842437cbb995404bc6e4a9a832449be696142c)
    #2 0xffff9fdf2228 in li_chunkqueue_append_mem
/root/lighttpd2/build-asan/../src/main/chunk.c:562:2
    #3 0xaaaae794bb1c in main /root/lighttpd2/chunkqueue.c:9:5
    #4 0xffff9f752598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0xffff9f752678 in __libc_start_main csu/../csu/libc-start.c:360:3
    #6 0xaaaae7864fac in _start (/root/lighttpd2/asan_test+0x34fac)
(BuildId:

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/