Open
Description
There are couple of issues with the current bpf_prog_test_run_opts()
API implementation:
- In the case when
ctx_in
passed to the above API is not NULL butctx_out
is NULL (which seems to be a valid scenario), ebpfcore assumes that thectx_out
is also not NULL (and of the same size asctx_in
), and overwrites the data in thedata_out
withctx_out
, corrupting the value indata_out
. There is no buffer overflow, butdata_out
is corrupted. - In the case when
data_out
buffer size provider by user mode app is more than actualdata_out
returned by extension after BPF program invocation, ebpfcore ignores the initialdata_out
size, and starts copyingctx_out
in thedata_out
buffer.