diff options
Diffstat (limited to 'package/libs/libubox/patches/0020-blobmsg-simplify-and-fix-name-length-checks-in-blobm.patch')
-rw-r--r-- | package/libs/libubox/patches/0020-blobmsg-simplify-and-fix-name-length-checks-in-blobm.patch | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/package/libs/libubox/patches/0020-blobmsg-simplify-and-fix-name-length-checks-in-blobm.patch b/package/libs/libubox/patches/0020-blobmsg-simplify-and-fix-name-length-checks-in-blobm.patch new file mode 100644 index 0000000000..e64d18afad --- /dev/null +++ b/package/libs/libubox/patches/0020-blobmsg-simplify-and-fix-name-length-checks-in-blobm.patch @@ -0,0 +1,47 @@ +From 639c29d19717616b809d9a1e9042461ab8024370 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau <nbd@nbd.name> +Date: Mon, 25 May 2020 14:49:35 +0200 +Subject: [PATCH] blobmsg: simplify and fix name length checks in + blobmsg_check_name + +blobmsg_hdr_valid_namelen was omitted when name==false +The blob_len vs blobmsg_namelen changes were not taking into account +potential padding between name and data + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + blobmsg.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +--- a/blobmsg.c ++++ b/blobmsg.c +@@ -54,8 +54,8 @@ static bool blobmsg_hdr_valid_namelen(co + + static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool name) + { +- char *limit = (char *) attr + len; + const struct blobmsg_hdr *hdr; ++ uint16_t namelen; + + hdr = blobmsg_hdr_from_blob(attr, len); + if (!hdr) +@@ -64,16 +64,11 @@ static bool blobmsg_check_name(const str + if (name && !hdr->namelen) + return false; + +- if (name && !blobmsg_hdr_valid_namelen(hdr, len)) ++ namelen = blobmsg_namelen(hdr); ++ if (blob_len(attr) < (size_t)blobmsg_hdrlen(namelen)) + return false; + +- if ((char *) hdr->name + blobmsg_namelen(hdr) + 1 > limit) +- return false; +- +- if (blobmsg_namelen(hdr) > (blob_len(attr) - sizeof(struct blobmsg_hdr))) +- return false; +- +- if (hdr->name[blobmsg_namelen(hdr)] != 0) ++ if (hdr->name[namelen] != 0) + return false; + + return true; |