CVEs-PoC/2021/CVE-2021-21401.md

### [CVE-2021-21401](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21401)
![](https://img.shields.io/static/v1?label=Product&message=nanopb&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.3.2%2C%20%3C%3D%200.3.9.7%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.4.0%2C%20%3C%3D%200.4.4%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-763%3A%20Release%20of%20Invalid%20Pointer%20or%20Reference&color=brightgreen)

### Description

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/HimanshuS67/external_nanopb-c_AOSP10_CVE-2021-21401
- https://github.com/uthrasri/CVE-2021-21401_nanopb-c_AOSP10_R33