GHSA-9c77-rgp9-c2g2: Web http client: Unchecked Server-Side Malicious Packet
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55085 |
Severity |
High |
CWE |
|
Published |
2025‑10‑17 |
Last updated |
2025‑10‑17 |
Description
Summary
The web client fails to validate server-side input properly, specifically when parsing HTTP headers. It can lead to an Out-of-Bounds (OOB) read, which constitutes undefined behavior.
Details
When the client processes HTTP header fields sent by the server, it looks for the ':' character to separate the field name from its value. However, there is no check to ensure the pointer (buffer_ptr) stays within the valid range of the buffer. If a malicious server sends malformed input, this may cause an OOB read due to unchecked pointer manipulation.
file: nx_web_http_client.c:6474
function: _nx_web_http_client_process_header_fields
/*
* The buffer pointer may increment past the buffer boundary
* if the response does not contain a ':'.
*/
/* Look for the ':' that separates the field name from its value. */
while(*buffer_ptr != ':')
{
buffer_ptr++;
field_name_length++;
}
Without proper bounds checking, the pointer (buffer_ptr) can move beyond the allocated buffer, leading to a potential memory access violation on malicious server input.