NFC: llcp: Limit size of SDP URI

PATCH New Kees Cook 1 participant 1 message Feb 9, 2018

Subsystems (2)

Networking NFC

lore

Share & tools

lore

Kees Cook

author

2018-02-09 20:04 UTC #0 lore raw

PATCH 1/1 NFC: llcp: Limit size of SDP URI

The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce this both in the NLA policy and in the code that performs the allocation and copy.

Fixes d9b8d8e19b073 ("NFC: llcp: Service Name Lookup netlink interface")

Signed-off-by Kees Cook <[email protected]>

---
Alternatively, tlv_len switch to size_t, but we'd still have to do the "-4" calculation.

---
 net/nfc/llcp_commands.c | 4 ++++
 net/nfc/netlink.c       | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)

net/nfc/llcp_commands.c +4 -0

index 367d8c027101..2ceefa183cee 100644
@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
 
 	pr_debug("uri: %s, len: %zu\n", uri, uri_len);
 
+	/* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
+	if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
+		return NULL;
+
 	sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
 	if (sdreq == NULL)
 		return NULL;

net/nfc/netlink.c +2 -1

index c0b83dc9d993..f018eafc2a0d 100644
@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
 };
 
 static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
-	[NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+	[NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
+			       .len = U8_MAX - 4 },
 	[NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };

Signature · 6 lines

2.7.4


-- 
Kees Cook
Pixel Security