# libevent (stack) buffer overflow in evutil_parse_sockaddr_port

Signed integer truncation in libevent's evutil_parse_sockaddr_port lets an oversized bracketed IPv6 string bypass a length check and overflow a 128-byte stack buffer.

- Payout: hidden
- Severity: medium
- Program: Tor
- Found by: guido
- Disclosed: 2017-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/112784
- Library page: https://bugbountylibrary.com/r/h1%3A112784
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:linux technique:source-review vuln:dos vuln:memory-corruption

**Target:** libevent evutil_parse_sockaddr_port (IPv6 address parsing)
**Root cause:** The length between '[' and ']' is cast to a signed 32-bit int; a length exceeding INT_MAX becomes negative, passing the `len > sizeof(buf)-1` check and causing memcpy to overflow the 128-byte stack buffer.
**Steps:**
1. Generate a resolv.conf with `generate-resolv.conf` containing an oversized bracketed address.
2. Compile and run `poc.c` (see entry-functions.txt for potentially vulnerable tor functions).
3. The oversized length truncates to a negative int at line 1815, bypasses the check at 1816, and memcpy at 1819 overflows `buf[128]`, causing a segfault.
**How found:** Code review of evutil.c: noticed the `(int)` cast of the pointer difference on line 1815 could produce a negative value for lengths above INT_MAX, defeating the subsequent size check.
**Insight:** When a size check compares a signed int derived from a pointer difference, look for lengths above INT_MAX that wrap negative; the check passes but memcpy still copies the huge length.