Shadowsocks-libev: Mishandling of json configuration file could lead to Null Pointer Dereference

Created on 16 Oct 2017 · 3Comments · Source: shadowsocks/shadowsocks-libev

What version of shadowsocks-libev are you using?

shadowsocks-libev-3.1.0

What operating system are you using?

Ubuntu 16.04 64 bit

What did you do?

In parsing json configuration file, two of the properties ("mode", "plugin") do not perform null checking before invoking strlen,

https://github.com/shadowsocks/shadowsocks-libev/blob/c67d275803dc6ea22c558d06b1f7ba9f94cd8de3/src/jconf.c#L248-L253

feeding null json value to "mode" or "plugin" property will trigger process crash.

PoC:

(py3) ➜  src   ./ss-server -c config.json
[1]    28610 segmentation fault (core dumped)  ./ss-server -c config.json
(py3) ➜  src   cat config.json
{
    "server":"my_server_ip",
    "server_port":8388,
    "local_address": "127.0.0.1",
    "local_port":1080,
    "password":"mypassword",
    "timeout":300,
    "method":"aes-256-cfb",
    "fast_open": false,
    "plugin": null
}