Repository navigation
Bad Inputs cause unhandled exceptions and permanent hang #196
Description
Activity
@JlKmn thanks for this I will look at it & your pull request when I get chance.
@milkshakeuk Great, once it is reviewed and merged I have deeper bugs of later Fuzzing Runs and fixes for them. I didn't want to have too much in one pull request.
@JlKmn, I am currently working on porting the newer
PipeParserfromhapito fix certain issues caused by unexpected segments (probably fixes other things too).The current
PipeParseryou have fuzzed will remain but be renamedLegacyPipeParser.It's probably good to have these fixes in the
LegacyPipeParseranyway but it might be useful if you could do the fuzzing again when the newPipeParseris in.Is that something you could do?
@JlKmn I'm not 100% sure, I'm just writing the unit tests to finish the PR off.
Hopefully in the next day or so?b"MSHH0\r"
whats the
bfor in front of your bad inputs?It's just to indicate that its python byte string output
Reacted by Jake Aitchison
Description
These bugs were gathered while Fuzzing the parsing function with Sharpfuzz and AFL.
On bad inputs an HL7Exception should be thrown but other exceptions occur on some inputs.
Exceptions and Inputs
b""
b"MSH|0|||||||00|||2.7"
b"MSHH0\r"
b"MSH|0|||||||||||0"
b"MSH|^\x01\0|||||0||ACK^\|||2.2^0\r0|0|2^V~\\r0|0|00\r0)0"
b"MSH|0|0|0|0|0|0|0|20\x7f|0|0|2.7"
b"MSH|^|||||||^A|||2.2\r^AA"
Environmental Details
Additional context
The permanent hang would potentially be DoS exploitable depending on what context the library is used in.
I will create a pull request that fixes these bugs and adds them as tests.