Network bootloader: HTTP headers heap buffer overflow

[jFriedli]

Bug Report

Issue details

The network bootloader HTTPparser allocates 1024 bytes for request headers but does not check the buffer length before writing received bytes.

In Tools/AP_Bootloader/network.cpp:

char *BL_Network::read_headers(SocketAPM *sock)
{
    char *ret = (char *)malloc(1024);
    char *p = ret;

    while (true) {
        char c;
        auto n = sock->recv(&c, 1, 100);
        if (n != 1) {
            break;
        }

        *p++ = c;

        if (p-ret >= 4 && strcmp(p-4, "\r\n\r\n") == 0) {
            break;
        }
    }

    return ret;
}

There is no check that p is still inside the 1024-byte allocation before *p++ = c.

When the network bootloader is active, the web server listens on 0.0.0.0:80, which mans a network peer that can reach the bootloader can trigger the overflow without HTTP authentication.

Minimal trigger:

import socket

t= "{IP}"

payload = (
    b"GET / HTTP/1.1\r\n"
    b"X-Test: "
    + b"A" * 2048
    + b"\r\n\r\n"
)

with socket.create_connection((t, 80), timeout=5) as s:
    s.sendall(payload)

I also reproduced the read_headers() logic under AddressSanitizer, which reports a heap-buffer-overflow once the 1024-byte allocation is exceeded.

The affected allocation uses the ChibiOS heap. In a controlled 32-bit ChibiOS allocator layout, the overflow was also sufficient to overwrite the complete following allocation header (heap and size fields). chHeapFree() later trusts these fields and uses them when manipulating the free list.

So the confirmed impact is an unauthenticated network-triggered heap overflow / memory corruption. Code execution may be possible depending on the actual heap layout of the target, but I have not confirmed target-specific RCE.

Firmware signing does not prevent triggering this because the overflow happens during HTTP header parsing, before firmware upload validation is reached.

Version

Current master tested:

be40f5985f608ef8baa7c653384a3ab3d3834a82

Platform

[x] All
[ ] AntennaTracker
[ ] Copter
[ ] Plane
[ ] Rover
[ ] Submarine

This is in the bootloader rather than a vehicle-specific application.

Airframe type

N/A

Hardware type

Confirmed network-bootloader configurations include:

• Pixhawk6X-PPPGW
• CubeRedPrimary-PPPGW

Both include network_bootloader.inc.

Other network-bootloader configurations using the same code may also be affected.

Logs

No flight logs are relevant.

Sanitizer reproduction confirms the heap overflow. The allocator test produced:

next allocation heap = 0x41424344
next allocation size = 0x51525354
AP02_CHIBIOS_HEAP_METADATA_CONTROL_CONFIRMED