From 143303149c8b87fec76b7f2f4b365baae1e18d2c Mon Sep 17 00:00:00 2001 From: Tobias Schramm Date: Wed, 28 Nov 2018 13:39:29 +0100 Subject: Ensure blob_attr length check does not perform out of bounds reads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before there might have been as little as one single byte left which would result in 3 bytes of blob_attr->id_len being out of bounds. Acked-by: Yousong Zhou Signed-off-by: Tobias Schramm [line wrapped < 72 chars] Signed-off-by: Petr Štetiar --- blobmsg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'blobmsg.h') diff --git a/blobmsg.h b/blobmsg.h index 0af0878..00e0fdc 100644 --- a/blobmsg.h +++ b/blobmsg.h @@ -266,7 +266,7 @@ int blobmsg_printf(struct blob_buf *buf, const char *name, const char *format, . #define blobmsg_for_each_attr(pos, attr, rem) \ for (rem = attr ? blobmsg_data_len(attr) : 0, \ pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \ - rem > 0 && (blob_pad_len(pos) <= rem) && \ + rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) -- cgit v1.2.3