From 43c733dc8934f060490f77dd756169d2387f415f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=BAben=20Soares=20Silva?= Date: Fri, 21 Mar 2025 17:52:53 +0000 Subject: [PATCH] Prevent pulling TLV tag and length over end of the buffer. Checks whether there are at least 4 bytes available to pull tag and length values. On tlv_list unpack, if the size is sent as 0, immediately exit the function --- nfapi/open-nFAPI/common/src/nfapi.c | 4 ++-- nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/nfapi/open-nFAPI/common/src/nfapi.c b/nfapi/open-nFAPI/common/src/nfapi.c index 716387ae7d..f997552c1e 100644 --- a/nfapi/open-nFAPI/common/src/nfapi.c +++ b/nfapi/open-nFAPI/common/src/nfapi.c @@ -889,8 +889,8 @@ int unpack_nr_tlv_list(unpack_tlv_t unpack_fns[], nfapi_tl_t generic_tl; uint8_t numBadTags = 0; uint16_t idx = 0; - - while ((uint8_t *)(*ppReadPackedMsg) < end) { + if (size == 0) { return 1; } + while ((uint8_t *)(*ppReadPackedMsg) + 4 < end) { // unpack the tl and process the values accordingly if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0) return 0; diff --git a/nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c b/nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c index 9339a666a3..6936d8b8fa 100644 --- a/nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c +++ b/nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c @@ -1347,7 +1347,7 @@ uint8_t unpack_nr_config_request(uint8_t **ppReadPackedMsg, uint8_t *end, void * nfapi_tl_t generic_tl; uint8_t numBadTags = 0; unsigned long idx = 0; - while ((uint8_t *)(*ppReadPackedMsg) < end) { + while ((uint8_t *)(*ppReadPackedMsg) + 4 < end) { // unpack the tl and process the values accordingly if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0) return 0;