[PATCH 1/2] net: ipv6: Fix CID 453851 and CID 436278

[Ramon Fried]

On Thu, May 18, 2023 at 10:35 PM <seanedmond at linux.microsoft.com> wrote:
>
> From: Sean Edmond <seanedmond at microsoft.com>
>
> CID 453851 : sprintf() shouldn't copy from/to tmp
> CID 436278 : DHCP6 option_len should be checked before use
>
> Signed-off-by: Sean Edmond <seanedmond at microsoft.com>
> ---
>  cmd/net.c    | 12 ++++++------
>  net/dhcpv6.c |  5 +++++
>  2 files changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/cmd/net.c b/cmd/net.c
> index 68d406291e..9e1f40a56e 100644
> --- a/cmd/net.c
> +++ b/cmd/net.c
> @@ -209,7 +209,7 @@ U_BOOT_CMD(
>
>  static void netboot_update_env(void)
>  {
> -       char tmp[44];
> +       char tmp[46];
>
>         if (net_gateway.s_addr) {
>                 ip_to_string(net_gateway, tmp);
> @@ -274,20 +274,20 @@ static void netboot_update_env(void)
>         if (IS_ENABLED(CONFIG_IPV6)) {
>                 if (!ip6_is_unspecified_addr(&net_ip6) ||
>                     net_prefix_length != 0) {
> -                       sprintf(tmp, "%pI6c", &net_ip6);
>                         if (net_prefix_length != 0)
> -                               sprintf(tmp, "%s/%d", tmp, net_prefix_length);
> -
> +                               snprintf(tmp, sizeof(tmp), "%pI6c/%d", &net_ip6, net_prefix_length);
> +                       else
> +                               snprintf(tmp, sizeof(tmp), "%pI6c", &net_ip6);
>                         env_set("ip6addr", tmp);
>                 }
>
>                 if (!ip6_is_unspecified_addr(&net_server_ip6)) {
> -                       sprintf(tmp, "%pI6c", &net_server_ip6);
> +                       snprintf(tmp, sizeof(tmp), "%pI6c", &net_server_ip6);
>                         env_set("serverip6", tmp);
>                 }
>
>                 if (!ip6_is_unspecified_addr(&net_gateway6)) {
> -                       sprintf(tmp, "%pI6c", &net_gateway6);
> +                       snprintf(tmp, sizeof(tmp), "%pI6c", &net_gateway6);
>                         env_set("gatewayip6", tmp);
>                 }
>         }
> diff --git a/net/dhcpv6.c b/net/dhcpv6.c
> index 0d1c600632..73a1067877 100644
> --- a/net/dhcpv6.c
> +++ b/net/dhcpv6.c
> @@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
>                 option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr);
>                 option_len = ntohs(option_hdr->option_len);
>
> +               if (option_ptr + option_len > rx_pkt + len) {
> +                       debug("Invalid option length\n");
> +                       return;
> +               }
> +
>                 switch (ntohs(option_hdr->option_id)) {
>                 case DHCP6_OPTION_CLIENTID:
>                         if (memcmp(option_ptr, sm_params.duid, option_len)
> --
> 2.40.0
>
Reviewed-by: Ramon Fried <rfried.dev at gmail.com>