[PATCH] net: wget: Avoid packet queue overflow
Tom Rini
trini at konsulko.com
Thu Aug 31 18:27:03 CEST 2023
On Thu, Aug 31, 2023 at 12:27:59PM +0200, Richard Weinberger wrote:
> ----- Ursprüngliche Mail -----
> > Von: "richard" <richard at nod.at>
> > An: u-boot at lists.denx.de
> > CC: "richard" <richard at nod.at>, "Joe Hershberger" <joe.hershberger at ni.com>, "Ramon Fried" <rfried.dev at gmail.com>
> > Gesendet: Donnerstag, 20. Juli 2023 14:51:56
> > Betreff: [PATCH] net: wget: Avoid packet queue overflow
>
> > Make sure to stay within bounds, as a misbehaving HTTP server
> > can trigger a buffer overflow if not properly handled.
> >
> > Cc: Joe Hershberger <joe.hershberger at ni.com>
> > Cc: Ramon Fried <rfried.dev at gmail.com>
> > Signed-off-by: Richard Weinberger <richard at nod.at>
> > ---
> > net/wget.c | 10 +++++++++-
> > 1 file changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/wget.c b/net/wget.c
> > index 2dbfeb1a1d5b..8bb4d72db1ae 100644
> > --- a/net/wget.c
> > +++ b/net/wget.c
> > @@ -35,7 +35,8 @@ struct pkt_qd {
> > * The actual packet bufers are in the kernel space, and are
> > * expected to be overwritten by the downloaded image.
> > */
> > -static struct pkt_qd pkt_q[PKTBUFSRX / 4];
> > +#define PKTQ_SZ (PKTBUFSRX / 4)
> > +static struct pkt_qd pkt_q[PKTQ_SZ];
> > static int pkt_q_idx;
> > static unsigned long content_length;
> > static unsigned int packets;
> > @@ -202,6 +203,13 @@ static void wget_connected(uchar *pkt, unsigned int
> > tcp_seq_num,
> > pkt_q[pkt_q_idx].tcp_seq_num = tcp_seq_num;
> > pkt_q[pkt_q_idx].len = len;
> > pkt_q_idx++;
> > +
> > + if (pkt_q_idx >= PKTQ_SZ) {
> > + printf("wget: Fatal error, queue overrun!\n");
> > + net_set_state(NETLOOP_FAIL);
> > +
> > + return;
> > + }
> > } else {
> > debug_cond(DEBUG_WGET, "wget: Connected HTTP Header %p\n", pkt);
> > /* sizeof(http_eom) - 1 is the string length of (http_eom) */
This seems fine and I'll pick it up soon. Thanks!
--
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20230831/2569fb11/attachment.sig>
More information about the U-Boot
mailing list