Submit #1013929: Hangzhou Xiongmai Technology Co., Ltd P2PAPI.dll 1.3.3.32 CWE-120: Buffer Copy without Checking Size of Input

CWE-120 Buffer Overflow in Xiongmai P2PAPI.dll

Component: P2PAPI.dll (Xiongmai P2P SDK wrapper)
Client tested: O-KAM SuperIPCam.exe version x.x.x.x
Class: CWE-120 - Buffer Copy without Checking Size of Input (Classic Buffer Overflow)
Impact: Local denial of service via heap corruption (STATUS_HEAP_CORRUPTION)
Remote reachability: Not established
Status: Reported to vendor
Disclosure: Coordinated, 90-day window

AFFECTED FILES

P2PAPI.dll
SHA-256: FEC22273E0186DCE5D7BD472AC1C42E8EBA6C32AD5B52490DADA7839DAE1CCEB

SuperIPCam.exe v1.3.3.32
SHA-256: C287E3C8E749BBFA8DFA9DE468EB06399036F387954F535E6E2FD8C272EE50F8

DLL MITIGATIONS (P2PAPI.dll PE header)

DllCharacteristics = 0x0140
DYNAMIC_BASE (ASLR) = enabled
NX_COMPAT (DEP) = enabled
GUARD_CF (CFG) = disabled
NO_SEH = false
HIGH_ENTROPY_VA = false

ROOT CAUSE (STATIC ANALYSIS)

Ghidra decompilation of FUN_1000b500 (preferred-base-relative 0x1000b500) shows an unbounded sscanf into fixed-size buffers:

char buf_a[0x80]; /* 128 bytes */
char buf_b[0x40]; /* 64 bytes */
char buf_c[0x100]; /* 256 bytes */

sscanf(input,
"%*c%*c%[^&]%*c%[^&]%*c%s", /* NO FIELD WIDTHS */
buf_a, buf_b, buf_c);

None of the conversions carry a maximum field width. Input longer than the destination buffer overruns it. Sibling functions FUN_10007fd0 and FUN_10004ef0 use the same pattern.

The vulnerable code is reached through the exported function P2PAPI_Connect (0x10004420), specifically when the second string argument is oversized.

TRIGGER

Call sequence:

P2PAPI_InitialWithServer("dummy") -> 0
P2PAPI_CreateInstance(&slot) -> 0, slot = 0
P2PAPI_Connect(slot, "arg1", PAYLOAD, "arg3")

PAYLOAD (901 bytes including NUL):

"VP" + 256 x 'A' + "&" + 128 x 'B' + "&" + 512 x 'C' + NUL

OBSERVED BEHAVIOR

A=16, B=16, C=16 : no overflow, exit code 0 (control)
A=128, B=16, C=16 : at limit, exit code 0
A=512, B=16, C=16 : +384 past buf_a, exit code 0
A=1024,B=16, C=16 : +896 past buf_a, exit code -1073740940
A=16, B=512, C=16 : +448 past buf_b, exit code 0
A=16, B=16, C=1024: +768 past buf_c, exit code -1073740940
A=256, B=128, C=512 : ~+448 total, exit code -1073740940

Exit code -1073740940 = 0xC0000374 = STATUS_HEAP_CORRUPTION.

The crash depends on the argument position (second string, not first) and on the write reaching the adjacent heap chunk header. Per-field one-byte overshoots are absorbed by heap slack; larger overshoots corrupt heap metadata and the Windows heap manager terminates the process.

IMPACT

Confirmed: local denial of service against any process that loads P2PAPI.dll and calls P2PAPI_Connect with an attacker-influenced second string argument.

Not established: remote reachability. The producer of the second argument in the client has not been traced to a network-controlled source.

Not demonstrated: code execution. Heap corruption was observed only as a DoS; no heap-grooming chain is claimed.

REMEDIATION

1. Bound all sscanf conversions with field widths matching destination sizes, e.g.:

int n = sscanf(input, "%*c%*c%127[^&]%*c%63[^&]%*c%255s",
buf_a, buf_b, buf_c);
if (n != 3) { /* error path */ }

2. Bound the strcpy-style loops in FUN_10007fd0 and FUN_10004ef0.

3. Validate input length at the P2PAPI_Connect boundary.

4. Recompile with /guard:cf (CFG currently disabled).

5. Confirm /GS stack cookies are active in release builds.

REPRODUCER ARTIFACTS

single.go - minimal single-shot reproducer (Go, 32-bit)
b1.go - per-invocation boundary tester
h.go - multi-parameter sweep
harness.log - captured output of the sweep

Compile with GOARCH=386. Source is not published here to avoid distributing a complete exploitation toolkit; the same behavior is reproducible from the description above by any reverse engineer.

TIMELINE

2026-10-04: Vulnerability confirmed locally
2026-10-04: Reported to vendor
(pending): Vendor acknowledgement
(pending): Public advisory publication (90-day target)

NOTES

A separate finding in the same client (plaintext HTTP resolver at FUN_0071bdc8) is documented in a distinct report.

• Source: ⚠️ https://gist.github.com/Ishanoshada/a47d24d77dd03f34c7f324491b59edac
• User: Anonymous User
• Submission: 10/05/2026 14:43 (27 days ago)
• Moderation: 10/31/2026 20:23 (26 days later)
• Status: Accepted
• VulDB entry: 429585 [Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows P2P SDK P2PAPI_Connect input buffer overflow]
• Points: 20