We are filing this as hardening and not as a security advisory. This is one of two issues the Netskope Threat Labs team discovered and is reporting. They share no root cause with this report and can be triaged independently.
Technical details
|
|
| Component |
boost/format/parsing.hpp:70-83,155-175,457-496 |
| Upstream tested |
boostorg/format @ 3fb39d7 (develop HEAD) |
| Class |
CWE-190 signed-int-overflow (UB only; no MC on real targets) |
| Severity |
LOW — CVSS ~2.0 |
| Reachability |
boost::format(attacker_format_string) |
Root cause
Triple signed-int overflow on attacker digits. On 2's-complement: %2147483648$d -> n=INT_MIN -> argN_=INT_MAX -> num_args_=INT_MIN. Downstream guards prevent OOB; UBSan trap only.
Trigger
boost::format("%2147483648$d")
Upstream status
STILL PRESENT in boostorg/format develop HEAD and 1.85.0
Suggested fix
Same str2int() clamp as SRC-11 closes this. Additionally, validate argN_ < some_max before using it as an index.
We are filing this as hardening and not as a security advisory. This is one of two issues the Netskope Threat Labs team discovered and is reporting. They share no root cause with this report and can be triaged independently.
Technical details
boost/format/parsing.hpp:70-83,155-175,457-496boost::format(attacker_format_string)Root cause
Triple signed-int overflow on attacker digits. On 2's-complement: %2147483648$d -> n=INT_MIN -> argN_=INT_MAX -> num_args_=INT_MIN. Downstream guards prevent OOB; UBSan trap only.
Trigger
boost::format("%2147483648$d")
Upstream status
STILL PRESENT in boostorg/format develop HEAD and 1.85.0
Suggested fix
Same
str2int()clamp as SRC-11 closes this. Additionally, validateargN_ < some_maxbefore using it as an index.