[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-driver-devel
Subject:    Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow
From:       "Jason A. Donenfeld" <Jason () zx2c4 ! com>
Date:       2015-05-26 14:58:26
Message-ID: CAHmME9qk2w+A_SPs5NoBRXWV+9N3TMzbp7eMSiiherHWQGLz+g () mail ! gmail ! com
[Download RAW message or body]

On Tue, May 26, 2015 at 3:56 PM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
>> elt->length is a u8, so the upper bound is 255.
>
> Yes.  I know that, but is 255 correct?

Eventually body->data is passed to oz_hcd_get_desc_cnf along with
data_len. In there, body->data (now called desc) is memcpy'd into a
URB transfer buffer. The checks to see if that transfer buffer is big
enough are broken and vulnerable, and another patch in this set
addresses that. But anyway, AFAIK, the 255 limit works fine for all
subsequent types used, after this patch set is applied. The use of a
u8 cannot, at this point, be *increased* since this protocol is tied
to particular hardware chips sold by Atmel/Ozmo. And I can't see a
reason why it should be further bounded either.
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
[prev in list] [next in list] [prev in thread] [next in thread]