# OOB read in libuv

OOB read in libuv's uv__idna_toascii UTF-8 decoder when converting untrusted hostnames, reachable via uv_getaddrinfo, causing crashes or info disclosure.

- Payout: hidden
- Severity: medium
- Program: Node.js
- Found by: ericsesterhenn
- Disclosed: 2021-07-05
- CVE: CVE-2021-22918
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1209681
- Library page: https://bugbountylibrary.com/r/h1%3A1209681
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:linux technique:fuzzing technique:source-review vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** libuv IDNA/UTF-8 decoder (uv__utf8_decode1_slow) reachable via uv_getaddrinfo
**Root cause:** uv__utf8_decode1_slow reads and increments pointer p without verifying it stays within pe (end of buffer), so multi-byte UTF-8 sequences near the buffer end cause out-of-bounds reads.
**Steps:**
1. Pass an untrusted hostname containing a truncated multi-byte UTF-8 sequence (leading byte >0xEF) to uv_getaddrinfo().
2. libuv calls uv__idna_toascii() which invokes uv__utf8_decode1_slow().
3. The decoder dereferences `*(*p)++` three times for a 4-byte sequence without checking `p + 3 > pe`.
4. Reads past the buffer end, causing info disclosure or a segfault on a guarded page.
**How found:** Found during a Cure53 audit of ExpressVPN via an ad-hoc fuzzer; the researcher noticed the pointer p was advanced without bounds checks against pe in the UTF-8 decoder.
**Exploitation:** Attacker supplies a crafted hostname with a truncated multi-byte UTF-8 sequence to any API resolving hostnames via uv_getaddrinfo(), triggering OOB reads that can crash the process.
**Insight:** When auditing UTF-8/IDNA decoders, check that multi-byte continuation reads validate remaining length (p+N vs pe) before each dereference; truncated sequences at buffer end are the classic trigger, and hostname resolution is a reachable sink.