[Warning] This PR is generated by AI

1. PR Title: Fix for Heap-Buffer-Overflow Vulnerability in PcapPlusPlus - OSV-2024-947

2. PR Description:

   • Bug Type: Heap-Buffer-Overflow
   • Summary: A heap-buffer-overflow vulnerability was discovered in PcapPlusPlus. The issue arises in the function pcpp::SomeIpSdLayer::getEntries() when attempting to create new SomeIpSdEntry objects without properly checking if sufficient memory is available in the buffer. This leads to access beyond the allocated memory, causing a heap-buffer-overflow.
   • Fix Summary: The patch introduces a bounds check in the getEntries function to ensure the remaining buffer length is adequate before creating a new SomeIpSdEntry object. If the length is insufficient, the loop terminates, preventing out-of-bounds access. This fix enhances the program's security and stability by preventing invalid memory access.

3. Sanitizer Report Summary: The AddressSanitizer report identified a heap-buffer-overflow when the program attempted to access 1 byte beyond a 66-byte allocated buffer. The issue occurs in pcpp::SomeIpSdEntry::SomeIpSdEntry and is triggered via the pcpp::SomeIpSdLayer::getEntries() function. The root cause is the lack of a bounds check before creating a new SomeIpSdEntry object.

4. Full Sanitizer Report:

   ==19259==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5070000000d4 at pc 0x563b691eb8e4 bp 0x7ffc2be6b2a0 sp 0x7ffc2be6b298
   READ of size 1 at 0x5070000000d4 thread T0
       #0 0x563b691eb8e3 in pcpp::SomeIpSdEntry::SomeIpSdEntry(pcpp::SomeIpSdLayer const*, unsigned long) /root/Packet++/src/SomeIpSdLayer.cpp:243:62
       #1 0x563b691ecf17 in pcpp::SomeIpSdLayer::getEntries() const /root/Packet++/src/SomeIpSdLayer.cpp:501:16
       #2 0x563b6911ab41 in readParsedPacket(pcpp::Packet, pcpp::Layer*) /root/Tests/Fuzzers/ReadParsedPacket.h:66:32
       #3 0x563b69118e82 in LLVMFuzzerTestOneInput /root/Tests/Fuzzers/FuzzTarget.cpp:66:5
       #4 0x563b690236d4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/root/out/FuzzTarget+0xd66d4) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #5 0x563b6900c806 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/root/out/FuzzTarget+0xbf806) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #6 0x563b690122ba in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/root/out/FuzzTarget+0xc52ba) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #7 0x563b6903ca76 in main (/root/out/FuzzTarget+0xefa76) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #8 0x7f56d55321c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
       #9 0x7f56d553228a in __libc_start_main csu/../csu/libc-start.c:360:3
       #10 0x563b690073d4 in _start (/root/out/FuzzTarget+0xba3d4) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
   
   0x5070000000d4 is located 2 bytes after 66-byte region [0x507000000090,0x5070000000d2)
   allocated by thread T0 here:
       #0 0x563b69115f21 in operator new[](unsigned long) (/root/out/FuzzTarget+0x1c8f21) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #1 0x563b691338c6 in pcpp::PcapFileReaderDevice::getNextPacket(pcpp::RawPacket&) /root/Pcap++/src/PcapFileDevice.cpp:338:28
       #2 0x563b69130e3f in pcpp::IFileReaderDevice::getNextPackets(pcpp::PointerVector<pcpp::RawPacket>&, int) /root/Pcap++/src/PcapFileDevice.cpp:117:22
       #3 0x563b69118bf4 in LLVMFuzzerTestOneInput /root/Tests/Fuzzers/FuzzTarget.cpp:46:14
       #4 0x563b690236d4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/root/out/FuzzTarget+0xd66d4) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #5 0x563b6900c806 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/root/out/FuzzTarget+0xbf806) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #6 0x563b690122ba in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/root/out/FuzzTarget+0xc52ba) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #7 0x563b6903ca76 in main (/root/out/FuzzTarget+0xefa76) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
       #8 0x7f56d55321c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
       #9 0x7f56d553228a in __libc_start_main csu/../csu/libc-start.c:360:3
       #10 0x563b690073d4 in _start (/root/out/FuzzTarget+0xba3d4) (BuildId: 93000ff544a57109e8c9d0f05ff03fc3e9715e92)
   
   SUMMARY: AddressSanitizer
   

5. Files Modified:

   • Packet++/src/SomeIpSdLayer.cpp

   --- a/Packet++/src/SomeIpSdLayer.cpp
   +++ b/Packet++/src/SomeIpSdLayer.cpp
   @@ -499,6 +499,10 @@
    
   		while (remainingLen > 0)
   		{
   +            // Ensure there is enough remaining length for a new entry
   +            if (remainingLen < sizeof(SomeIpSdEntry::someipsdhdrentry)) {
   +                break;
   +            }
   			entry = new SomeIpSdEntry(this, offset);
    
   			size_t entryLen = entry->getLength();

6. Patch Validation: The patch has been validated using the provided PoC, and the heap-buffer-overflow vulnerability has been resolved. No new issues have been introduced.

7. Links:

   • Original Vulnerability Report
   • PoC