Golioth Firmware SDK vulnerabilities

In Golioth Firmware SDK versions 0.19.1 through 0.21.0, there is an out-of-bounds read vulnerability due to improper null termination of a blockwise transfer path. The blockwise_transfer_init() function copies the path using strncpy() without guaranteeing a trailing NUL byte, leaving the buffer unterminated. A subsequent strlen() call on this buffer can read past the allocated memory, causing a crash or denial of service.

In Golioth Firmware SDK versions 0.10.0 through 0.22.0, there is an out-of-bounds read vulnerability in LightDB State string parsing. When payload_size is less than 2, a size_t underflow occurs when computing the number of bytes to copy, and the subsequent memcpy() reads past the end of the network buffer, potentially crashing the device.

In Golioth Firmware SDK versions 0.10.0 through 0.22.0 (before commit 48f521b), a stack-based buffer overflow exists in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size, with length checks only guarded by assert() which are compiled out in release builds. Payloads larger than 12 bytes (int) or 32 bytes (float) can overflow the stack, causing a crash/denial of service.