lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 251/410] NFC: llcp: Limit size of SDP URI
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Kees Cook <keescook@chromium.org>

    commit fe9c842695e26d8116b61b80bfb905356f07834b upstream.

    The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce
    this both in the NLA policy and in the code that performs the allocation
    and copy, to avoid writing past the end of the allocated buffer.

    Fixes: d9b8d8e19b073 ("NFC: llcp: Service Name Lookup netlink interface")
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/nfc/llcp_commands.c | 4 ++++
    net/nfc/netlink.c | 3 ++-
    2 files changed, 6 insertions(+), 1 deletion(-)

    --- a/net/nfc/llcp_commands.c
    +++ b/net/nfc/llcp_commands.c
    @@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_

    pr_debug("uri: %s, len: %zu\n", uri, uri_len);

    + /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
    + if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
    + return NULL;
    +
    sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
    if (sdreq == NULL)
    return NULL;
    --- a/net/nfc/netlink.c
    +++ b/net/nfc/netlink.c
    @@ -60,7 +60,8 @@ static const struct nla_policy nfc_genl_
    };

    static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
    - [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
    + [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
    + .len = U8_MAX - 4 },
    [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
    };

    \
     
     \ /
      Last update: 2018-06-07 17:33    [W:2.246 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site