fix: use lzo1x_decompress_safe to prevent stack buffer overflow (CAN-2026-2035137) - #1245
Merged
Merged
Conversation
Replace lzo1x_decompress() with lzo1x_decompress_safe() in transop_decode_lzo(). The unsafe variant does not enforce the output buffer size limit, allowing a crafted compressed payload to overflow the N2N_PKT_BUF_SIZE (2048 byte) stack buffer in handle_PACKET(). The safe variant (already bundled in src/minilzo.c) validates output bounds during decompression, preventing the overflow. The post-decompression size check was ineffective because the overflow had already occurred before the check executed. CAN-2026-2035137
hamishcoleman
added a commit
to hamishcoleman/n3n
that referenced
this pull request
Aug 7, 2026
This commit was based on the n2n commit 4831375d6ec7. That commit was proposed as ntop/n2n#1245 This change has a 1% performance regression due to the extra checks added in the lzo1x_decompress_safe() compared to lzo1x_decompress() (On my system, benchmark showed that using lzo1x_decompress was 166 cycles but lzo1x_decompress_safe is 172 cycles) The n2n commit mentions some opaque "CAN" reference, but at the time of committing, there is no matches anywhere on the internet for that reference - suggesting that some or all of the n2n contribution was hallucinated by an LLM. Based on the original committer email address, this reference could also be an Amazon internal reference, but the total lack of clarity or referenceability makes that probably less useful than a hallucination. The actual source code for the vendored copy of the minilzo library has been examined to confirm the expected changes in the two functions and the test suite continues to pass after this change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace
lzo1x_decompress()withlzo1x_decompress_safe()intransop_decode_lzo()to prevent a stack buffer overflow.Problem
The unsafe
lzo1x_decompress()does not enforce an output buffer size limit. A crafted LZO-compressed payload that decompresses to more thanN2N_PKT_BUF_SIZE(2048) bytes overflows the stack bufferdeflate_bufinhandle_PACKET()(edge_utils.c:1718).The post-decompression size check (
if(deflated_len > N2N_PKT_BUF_SIZE)) was ineffective because the overflow already occurred during decompression.Fix
Use
lzo1x_decompress_safe()which validates output bounds during decompression. This function is already bundled insrc/minilzo.cbut was not being used.Reference
CAN-2026-2035137