Heap buffer overflow: createClient() indexes clients[fd] with no bound on fd

[router0mail]

Summary

clients[MAX_CLIENTS] (smallchat-server.c) is indexed directly by the socket file descriptor with no bound check before the write. When the kernel hands accept() a descriptor fd >= 1000 (MAX_CLIENTS), createClient() writes past the end of the heap-allocated chatState struct.

// smallchat-server.c:84 createClient(int fd)
assert(Chat->clients[c->fd] == NULL);   // OOB READ when fd >= 1000 (assert, compiled out via -DNDEBUG)
Chat->clients[c->fd] = c;               // OOB WRITE when fd >= 1000 -- heap overflow

clients[MAX_CLIENTS] is the last member of chatState (offset 8016 bytes), so clients[1000] writes exactly 8 bytes past the object.

Reachability

The kernel allocates the lowest free descriptor to accept(). A client holding ~997 concurrent connections (routine for a chat server, well under typical ulimit -n) makes the next accept() return fd = 1000 -> createClient(1000) -> the OOB write. No special payload, no race -- just connection count.

Verification (AddressSanitizer)

Built with gcc -fsanitize=address -fno-omit-frame-pointer -g smallchat-server.c chatlib.c -o sc-asan, then opened 1050 concurrent connections.

Release build (-DNDEBUG, assert compiled out) -- OOB WRITE:

ERROR: AddressSanitizer: heap-buffer-overflow on address 0xffff7cc02050
WRITE of size 8 ...
    #0 in createClient smallchat-server.c:86
    #1 in main            smallchat-server.c:189
0xffff7cc02050 is located 0 bytes to the right of 8016-byte region
SUMMARY: AddressSanitizer: heap-buffer-overflow smallchat-server.c:86 in createClient

Suggested fix

if (fd >= MAX_CLIENTS) {
    close(fd);
    return NULL;
}

and guard the j <= maxclient loops with j < MAX_CLIENTS.

---

This report was produced with AI assistance (Claude, Anthropic) performing source analysis and building/running the ASan proof-of-concept described above.