diff mbox series

[OpenWrt-Devel,v3,1/3] Ensure blob_attr length check does not perform out of bounds reads

Message ID 20181128013523.5793-2-tobleminer@gmail.com
State Superseded
Delegated to: John Crispin
Headers show
Series libubox: Enhance robustness of blobmsg parsing | expand

Commit Message

Tobias Schramm Nov. 28, 2018, 1:35 a.m. UTC 
Before there might have been as little as one single byte left which would result
in 3 bytes of blob_attr->id_len being out of bounds

Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
---
 blob.h    | 4 ++--
 blobmsg.h | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

Comments

Yousong Zhou Nov. 28, 2018, 2:25 a.m. UTC | #1 
On Wed, 28 Nov 2018 at 09:35, Tobias Schramm <tobleminer@gmail.com> wrote:
>
> Before there might have been as little as one single byte left which would result
> in 3 bytes of blob_attr->id_len being out of bounds
>
> Signed-off-by: Tobias Schramm <tobleminer@gmail.com>

Acked-by: Yousong Zhou <yszhou4tech@gmail.com>

                yousong
diff mbox series

Patch

diff --git a/blob.h b/blob.h
index a092f5d..2304f8c 100644
--- a/blob.h
+++ b/blob.h
@@ -242,7 +242,7 @@  blob_put_u64(struct blob_buf *buf, int id, uint64_t val)
 
 #define __blob_for_each_attr(pos, attr, rem) \
 	for (pos = (struct blob_attr *) attr; \
-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
 
@@ -250,7 +250,7 @@  blob_put_u64(struct blob_buf *buf, int id, uint64_t val)
 #define blob_for_each_attr(pos, attr, rem) \
 	for (rem = attr ? blob_len(attr) : 0, \
 	     pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \
-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
 
diff --git a/blobmsg.h b/blobmsg.h
index b06ef59..c75f1d9 100644
--- a/blobmsg.h
+++ b/blobmsg.h
@@ -266,7 +266,7 @@  int blobmsg_printf(struct blob_buf *buf, const char *name, const char *format, .
 #define blobmsg_for_each_attr(pos, attr, rem) \
 	for (rem = attr ? blobmsg_data_len(attr) : 0, \
 	     pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \
-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
 	     rem -= blob_pad_len(pos), pos = blob_next(pos))