Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-09-21 03:43:03 +00:00
Code Issues Projects Releases Wiki Activity

NFC: llcp: Limit size of SDP URI

Browse source 
commit fe9c842695e26d8116b61b80bfb905356f07834b upstream.

The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce
this both in the NLA policy and in the code that performs the allocation
and copy, to avoid writing past the end of the allocated buffer.

Fixes: d9b8d8e19b ("NFC: llcp: Service Name Lookup netlink interface")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
Kees Cook 2018-02-14 15:45:07 -08:00 committed by syphyr
parent 381d93ae74
commit 6a9c191da4
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/nfc/llcp_commands.c
View file

@ -151,6 +151,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
pr_debug("uri: %s, len: %zu\n", uri, uri_len); pr_debug("uri: %s, len: %zu\n", uri, uri_len);
/* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
return NULL;
sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL); sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
if (sdreq == NULL) if (sdreq == NULL)
return NULL; return NULL;

3
net/nfc/netlink.c
View file

@ -59,7 +59,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
}; };
static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = { static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
[NFC_SDP_ATTR_URI] = { .type = NLA_STRING }, [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
.len = U8_MAX - 4 },
[NFC_SDP_ATTR_SAP] = { .type = NLA_U8 }, [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
}; };