DGNum/libubox
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix reads beyond the end of the buffer when iterating over blob attributes

Browse source
This commit is contained in:
Felix Fietkau 2011-10-03 12:36:46 +02:00
parent 8cada85b61
commit 591a1e349f
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
blob.h
View file

@ -258,14 +258,14 @@ blob_put_int64(struct blob_buf *buf, int id, uint64_t val)
#define __blob_for_each_attr(pos, attr, rem) \ #define __blob_for_each_attr(pos, attr, rem) \
for (pos = (void *) attr; \ for (pos = (void *) attr; \
(blob_pad_len(pos) <= rem) && \ rem > 0 && (blob_pad_len(pos) <= rem) && \
(blob_pad_len(pos) >= sizeof(struct blob_attr)); \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
rem -= blob_pad_len(pos), pos = blob_next(pos)) rem -= blob_pad_len(pos), pos = blob_next(pos))
#define blob_for_each_attr(pos, attr, rem) \ #define blob_for_each_attr(pos, attr, rem) \
for (rem = blob_len(attr), pos = blob_data(attr); \ for (rem = blob_len(attr), pos = blob_data(attr); \
(blob_pad_len(pos) <= rem) && \ rem > 0 && (blob_pad_len(pos) <= rem) && \
(blob_pad_len(pos) >= sizeof(struct blob_attr)); \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
rem -= blob_pad_len(pos), pos = blob_next(pos)) rem -= blob_pad_len(pos), pos = blob_next(pos))

2
blobmsg.h
View file

@ -177,7 +177,7 @@ void blobmsg_add_string_buffer(struct blob_buf *buf);
#define blobmsg_for_each_attr(pos, attr, rem) \ #define blobmsg_for_each_attr(pos, attr, rem) \
for (rem = blobmsg_data_len(attr), pos = blobmsg_data(attr); \ for (rem = blobmsg_data_len(attr), pos = blobmsg_data(attr); \
(blob_pad_len(pos) <= rem) && \ rem > 0 && (blob_pad_len(pos) <= rem) && \
(blob_pad_len(pos) >= sizeof(struct blob_attr)); \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
rem -= blob_pad_len(pos), pos = blob_next(pos)) rem -= blob_pad_len(pos), pos = blob_next(pos))