diff mbox series

[OpenWrt-Devel,libubox,2/3] blobmsg: simplify and fix name length checks in blobmsg_check_name

Message ID 20200525151908.3930-2-nbd@nbd.name
State Accepted
Delegated to: Felix Fietkau
Headers show
Series [OpenWrt-Devel,libubox,1/3] blobmsg: fix length in blobmsg_check_array | expand

Commit Message

Felix Fietkau May 25, 2020, 3:19 p.m. UTC 
blobmsg_hdr_valid_namelen was omitted when name==false
The blob_len vs blobmsg_namelen changes were not taking into account
potential padding between name and data

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 blobmsg.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

Comments

Rafał Miłecki May 25, 2020, 4:48 p.m. UTC | #1 
On 25.05.2020 17:19, Felix Fietkau wrote:
> blobmsg_hdr_valid_namelen was omitted when name==false
> The blob_len vs blobmsg_namelen changes were not taking into account
> potential padding between name and data
> 
> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Tested-by: Rafał Miłecki <rafal@milecki.pl>
diff mbox series

Patch

diff --git a/blobmsg.c b/blobmsg.c
index daaa9fc8444b..308bef7bc6b0 100644
--- a/blobmsg.c
+++ b/blobmsg.c
@@ -48,8 +48,8 @@  static bool blobmsg_hdr_valid_namelen(const struct blobmsg_hdr *hdr, size_t len)
 
 static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool name)
 {
-	char *limit = (char *) attr + len;
 	const struct blobmsg_hdr *hdr;
+	uint16_t namelen;
 
 	hdr = blobmsg_hdr_from_blob(attr, len);
 	if (!hdr)
@@ -58,16 +58,11 @@  static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool na
 	if (name && !hdr->namelen)
 		return false;
 
-	if (name && !blobmsg_hdr_valid_namelen(hdr, len))
-		return false;
-
-	if ((char *) hdr->name + blobmsg_namelen(hdr) + 1 > limit)
-		return false;
-
-	if (blobmsg_namelen(hdr) > (blob_len(attr) - sizeof(struct blobmsg_hdr)))
+	namelen = blobmsg_namelen(hdr);
+	if (blob_len(attr) < (size_t)blobmsg_hdrlen(namelen))
 		return false;
 
-	if (hdr->name[blobmsg_namelen(hdr)] != 0)
+	if (hdr->name[namelen] != 0)
 		return false;
 
 	return true;