At ospdcommon.c, on the osdpreplyname function, any reply id between REPLYACK and REPLY_XRD is valid, but names array do not declare all of the range. On a case of an undefined reply id within the range, name will be null (name = names[reply_id - REPLY_ACK];
). Null name will casue a crash on next line: if (name[0] == '\0')
as null[0] is invalid.
As this logic is not limited to a secure connection, attacker may trigger this vulnerability without any prior knowledge.
Denial of Service
The issue has been patched in 24409e98a260176765956ec766a04cb35984fab1
{ "nvd_published_at": "2024-11-12T16:15:26Z", "cwe_ids": [ "CWE-476" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-08T17:33:46Z" }