Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe9c8426 authored by Kees Cook's avatar Kees Cook Committed by David S. Miller
Browse files

NFC: llcp: Limit size of SDP URI 



The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce
this both in the NLA policy and in the code that performs the allocation
and copy, to avoid writing past the end of the allocated buffer.

Fixes: d9b8d8e1 ("NFC: llcp: Service Name Lookup netlink interface")
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c410c196

net/nfc/llcp_commands.c

+4 −0
Original line number Diff line number Diff line
@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri, 


	pr_debug("uri: %s, len: %zu\n", uri, uri_len);



	/* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */

	if (WARN_ON_ONCE(uri_len > U8_MAX - 4))

		return NULL;



	sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);

	if (sdreq == NULL)

		return NULL;

net/nfc/netlink.c

+2 −1
Original line number Diff line number Diff line
@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { 
};



static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {

	[NFC_SDP_ATTR_URI] = { .type = NLA_STRING },

	[NFC_SDP_ATTR_URI] = { .type = NLA_STRING,

			       .len = U8_MAX - 4 },

	[NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },

};