From 37d9f374d9f0c47c092f80a5d85d4505ae4a9af7 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Mon, 17 Mar 2025 20:24:19 +1100 Subject: packet: Avoid integer overflows in packet_get_do() In packet_get_do() both offset and len are essentially untrusted. We do some validation of len (check it's < PACKET_MAX_LEN), but that's not enough to ensure that (len + offset) doesn't overflow. Rearrange our calculation to make sure it's safe regardless of the given offset & len values. Signed-off-by: David Gibson Signed-off-by: Stefano Brivio --- packet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packet.c b/packet.c index 08076d5..fdc4be7 100644 --- a/packet.c +++ b/packet.c @@ -144,7 +144,8 @@ void *packet_get_do(const struct pool *p, size_t idx, size_t offset, return NULL; } - if (len + offset > p->pkt[idx].iov_len) { + if (offset > p->pkt[idx].iov_len || + len > (p->pkt[idx].iov_len - offset)) { if (func) { trace("data length %zu, offset %zu from length %zu, " "%s:%i", len, offset, p->pkt[idx].iov_len, -- cgit v1.2.3