the message length is controlled by qTox not toxcore
and the toxcore's function that called tox_friend_add will invoke another function that called m_addfriend in the end
and the Messenger pointer is widely used inside toxcore implementation but the idea of triggering the BOF vulnerability due to the message handling doesn't make sense to me IMHO because even if the size check is not a problem to him thanks to the Egg-hunting techniques, the ToxString is implemented based on Qt QByteArray's Class
and if anyone reads the official documentation of QByteArray class, he would know that even the null terminator is size countable.
So in my personal opinion there is no BOF(RCE), or at least not in the same way he showed us in gif but as a precaution, it should not be used.
C++:
// https://github.com/qTox/qTox/blob/master/src/core/core.cpp#L660-L675
void Core::requestFriendship(const ToxId& friendId, const QString& message) {
// --snip--
ToxString cMessage(message);
Tox_Err_Friend_Add error;
uint32_t friendNumber = tox_friend_add(tox.get(), friendId.getBytes(), cMessage.data(), cMessage.size(), &error);
// --snip--
}
C:
// https://github.com/TokTok/c-toxcore/blob/master/toxcore/Messenger.c#L231-L290
int32_t m_addfriend(Messenger *m, const uint8_t *address, const uint8_t *data, uint16_t length) {
// * another size check from the toxcore*
if (length > MAX_FRIEND_REQUEST_DATA_SIZE) {
return FAERR_TOOLONG;
}
// --snip--
memcpy(m->friendlist[ret].info, data, length);
// --snip--
}
C++:
// https://github.com/qTox/qTox/blob/master/src/core/toxstring.cpp
ToxString::ToxString(const uint8_t* text, size_t length)
{
assert(length <= INT_MAX);
string = QByteArray(reinterpret_cast<const char*>(text), length);
}
/**
* @brief Returns a pointer to the beginning of the string data.
* @return Pointer to the beginning of the string data.
*/
const uint8_t* ToxString::data() const
{
return reinterpret_cast<const uint8_t*>(string.constData());
}
/**
* @brief Get the number of bytes in the string.
* @return Number of bytes in the string.
*/
size_t ToxString::size() const
{
return string.size();
}So in my personal opinion there is no BOF(RCE), or at least not in the same way he showed us in gif but as a precaution, it should not be used.
