gmg137 snap7-rs Heap-Based Buffer Overflow Vulnerability in opWriteArea Function

A heap-based buffer overflow vulnerability has been identified in the gmg137 snap7-rs library, affecting versions up to 1.142.1. The issue arises in the TSnap7MicroClient::opWriteArea function within s7_micro_client.cpp. This vulnerability can be exploited remotely, allowing attackers to manipulate the function's input and cause a heap overflow.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, where the overflowed memory can be controlled by an attacker, potentially allowing for arbitrary code execution or causing a crash.

Reproduction

The vulnerability can be reproduced by calling the 'ct_write' method of the 'S7Client' class with a crafted payload that includes an unconstrained size parameter. This can be done using a fuzzing tool that targets the 'snap7_rs' library.