Exploitable Blowtorch telnet protocol crash

[blockda]

Reported via email.

[blockda]

We found a critical bug when sending text to one of our users previewing the GMCP support the mud MUME. The user's Blowtorch app crashed, and she had to reboot her phone. Obviously, this can be exploited by a malicious user in player killing MUDs so it's somewhat critical that it is fixed and an update be pushed to the app store ASAP.

BlowTorch/BTLib/src/com/offsetnull/bt/service/Processor.java

Lines 193 to 196 in 22ad3ca

	case TC.IAC:
	buff.put(data[i]); // and one IAC and consume the extra.
	count++;
	break;

does do "i++", and it doesn't fall through to

BlowTorch/BTLib/src/com/offsetnull/bt/service/Processor.java

Line 210 in 22ad3ca

i++; // consume the byte.

result:

"IAC IAC SB GMCP ... IAC IAC" displays byte 255, and then it processes "IAC SB GMCP ... IAC IAC".

BlowTorch/BTLib/src/com/offsetnull/bt/service/Processor.java

Lines 128 to 137 in 22ad3ca

	while (!done) {
	if (data[j] == TC.IAC) {
	if (data[j + 1] == TC.SE) {
	done = true;
	}
	} else {
	//opbuf.put(data[j]);
	j++;
	}
	}

runs out of bounds trying to find "IAC SE", so it throws an exception and crashes.

So we found at least two bugs:

1. IAC IAC doesn't eat the character.

2. IAC SB XXX doesn't bounds check when searching for IAC SE

There's no telling what would have happened if I had included the SE,

because it would have processed [IAC] "IAC SB GMCP ... IAC IAC SE". I didn't look to see what happens if it can't "unescape" the payload data.