Missing index check on desc_table array access in runtime deserialization pony_deserialise_offset

[masthoon]

Inside pony_deserialise_offset, If no type is defined for the deserialisation, the type is read from the serialized stream:

ponyc/src/libponyrt/gc/serialise.c

Lines 281 to 282 in b1fe1a0

	uintptr_t id = *(uintptr_t*)((uintptr_t)ctx->serialise_buffer + offset);
	t = desc_table[id];

The index id should be validated to be lower than the value of desc_table_size.

Note:

The deserialisation is already documented as unsafe because the deserialized object fields are never validated.

[SeanTAllen]

Additional context: https://ponylang.zulipchat.com/#narrow/stream/190365-runtime/topic/Unsafe.20deserialise.20exploitation

[SeanTAllen]

We don't have any good way to deal with errors of this sort in the serialization of this sort. Some investigation of what we should do when we get unexpected values. Serialization was written for "totally trusted/may segfault". We probably want to throw an error but we need to verify that we are always good for doing it.

[jemc]

What probably needs to happen for the error case is to call the "throw fn" passed to pony_deserialise with some code like this:

      serialise_cleanup(ctx);
      ctx->serialise_throw();
      abort();