lib: when receiving data, make sure to not copy one packet to much

klali · klali · commit f526546bb29f · 2019-01-08T10:12:08.000+01:00
this might lead to a 64 byte buffer-overflow
diff --git a/u2f-host/u2fmisc.c b/u2f-host/u2fmisc.c
@@ -312,6 +312,10 @@ u2fh_sendrecv (u2fh_devs * devs, unsigned index, uint8_t cmd,
 		     frame.cont.seq, sequence);
 	    return U2FH_TRANSPORT_ERROR;
 	  }
+	if (recvddata + sizeof (frame.cont.data) > maxlen)
+	  {
+	    return U2FH_TRANSPORT_ERROR;
+	  }
 	memcpy (recv + recvddata, frame.cont.data, sizeof (frame.cont.data));
 	recvddata += sizeof (frame.cont.data);
       }

Original file line number	Diff line number	Diff line change
`@@ -312,6 +312,10 @@ u2fh_sendrecv (u2fh_devs * devs, unsigned index, uint8_t cmd,`
`312`	`312`	`frame.cont.seq, sequence);`
`313`	`313`	`return U2FH_TRANSPORT_ERROR;`
`314`	`314`	`}`
	`315`	`+ if (recvddata + sizeof (frame.cont.data) > maxlen)`
	`316`	`+ {`
	`317`	`+ return U2FH_TRANSPORT_ERROR;`
	`318`	`+ }`
`315`	`319`	`memcpy (recv + recvddata, frame.cont.data, sizeof (frame.cont.data));`
`316`	`320`	`recvddata += sizeof (frame.cont.data);`
`317`	`321`	`}`