From 143303149c8b87fec76b7f2f4b365baae1e18d2c Mon Sep 17 00:00:00 2001 From: Tobias Schramm Date: Wed, 28 Nov 2018 13:39:29 +0100 Subject: Ensure blob_attr length check does not perform out of bounds reads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before there might have been as little as one single byte left which would result in 3 bytes of blob_attr->id_len being out of bounds. Acked-by: Yousong Zhou Signed-off-by: Tobias Schramm [line wrapped < 72 chars] Signed-off-by: Petr Štetiar --- blob.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'blob.h') diff --git a/blob.h b/blob.h index af03360..6d61876 100644 --- a/blob.h +++ b/blob.h @@ -243,7 +243,7 @@ blob_put_u64(struct blob_buf *buf, int id, uint64_t val) #define __blob_for_each_attr(pos, attr, rem) \ for (pos = (struct blob_attr *) attr; \ - rem > 0 && (blob_pad_len(pos) <= rem) && \ + rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) @@ -251,7 +251,7 @@ blob_put_u64(struct blob_buf *buf, int id, uint64_t val) #define blob_for_each_attr(pos, attr, rem) \ for (rem = attr ? blob_len(attr) : 0, \ pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \ - rem > 0 && (blob_pad_len(pos) <= rem) && \ + rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) -- cgit v1.2.3