[Git][NTPsec/ntpsec][master] ntpd/nts.c: stop find_end_marker() at a partial record

[Gary E. Miller (@garyedmundsmiller)]

Gary E. Miller pushed to branch master at NTPsec / ntpsec


Commits:
97be66b4 by Matt Selsky at 2026-10-13T16:44:51-07:00
ntpd/nts.c: stop find_end_marker() at a partial record

find_end_marker() advanced buff by each record's length before checking
that the record fit in the bytes read so far. A record whose length runs
past the data left buff pointing beyond the end of the buffer, which is
undefined behavior even though it was never dereferenced, and Coverity
reports the untrusted length as a loop bound (CID 657248).

Return false as soon as a record extends past the data read. The result
is the same, since the caller keeps reading until the end marker
arrives.

- - - - -


1 changed file:

- ntpd/nts.c


Changes:

=====================================
ntpd/nts.c
=====================================
@@ -295,6 +295,7 @@ static bool find_end_marker(uint8_t *buff, int bytes) {
     uint16_t *buff16 = (uint16_t *)buff;
     uint16_t type = ntohs(*buff16++) & ~NTS_CRITICAL;
     uint16_t length = ntohs(*buff16++);
+    if (NTS_KE_HDR_LNG + length > bytes) return false;
     if (nts_end_of_message == type) return true;
     buff += NTS_KE_HDR_LNG + length;
     bytes -= NTS_KE_HDR_LNG + length;



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20261013/51e40d0c/attachment.htm>