NULL byte overflow in dlt_message_argument_print

[jch6637]

Summary

A buffer overflow vulnerability exists in the DLT_MSG_READ_STRING function called by the dlt_message_argument_print function.
NULL byte overflow occurs when copying a string of DLT_CONVERT_TEXTBUFSIZE (10024) length.

Details

1. Execute dlt-convert with the -a argument, using a DLT file containing a string of length DLT_CONVERT_TEXTBUFSIZE
2. The functions are called in the following sequence:
   dlt_message_payload -> dlt_message_argument_print -> DLT_MSG_READ_STRING
3. After the execution of memcpy and dlt_clean_string functions, the statement dst[length] = 0 is executed, resulting in a NULL byte overflow
   (https://github.com/COVESA/dlt-daemon/blob/master/include/dlt/dlt_common.h#L323)

Test environment

• OS: Ubuntu 22.04
• gcc: 11.4.0
• DLT Package Version: 2.18.10 STABLE
• Package Revision: v2.18.10_34_ga465513

Attachment

Attachment.zip
Attaching the DLT file capable of triggering the vulnerability and the ASAN report.
The vulnerability can be reproduced by executing the command dlt-convert -a ./poc.dlt.