diff options
| author | Richard Weinberger <richard@nod.at> | 2023-07-20 15:51:56 +0300 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2023-09-22 20:58:51 +0300 |
| commit | a8bd5ec00022cc6cf790b766abaa9c4f6c850add (patch) | |
| tree | 66a8784dabef2c4a18313ea3f61d784bd4bc4888 | |
| parent | d01a8541d62d78ad76706617e9f8690c8cb01fb8 (diff) | |
| download | u-boot-a8bd5ec00022cc6cf790b766abaa9c4f6c850add.tar.xz | |
net: wget: Avoid packet queue overflow
Make sure to stay within bounds, as a misbehaving HTTP server
can trigger a buffer overflow if not properly handled.
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
| -rw-r--r-- | net/wget.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/net/wget.c b/net/wget.c index 2dbfeb1a1d..8bb4d72db1 100644 --- a/net/wget.c +++ b/net/wget.c @@ -35,7 +35,8 @@ struct pkt_qd { * The actual packet bufers are in the kernel space, and are * expected to be overwritten by the downloaded image. */ -static struct pkt_qd pkt_q[PKTBUFSRX / 4]; +#define PKTQ_SZ (PKTBUFSRX / 4) +static struct pkt_qd pkt_q[PKTQ_SZ]; static int pkt_q_idx; static unsigned long content_length; static unsigned int packets; @@ -202,6 +203,13 @@ static void wget_connected(uchar *pkt, unsigned int tcp_seq_num, pkt_q[pkt_q_idx].tcp_seq_num = tcp_seq_num; pkt_q[pkt_q_idx].len = len; pkt_q_idx++; + + if (pkt_q_idx >= PKTQ_SZ) { + printf("wget: Fatal error, queue overrun!\n"); + net_set_state(NETLOOP_FAIL); + + return; + } } else { debug_cond(DEBUG_WGET, "wget: Connected HTTP Header %p\n", pkt); /* sizeof(http_eom) - 1 is the string length of (http_eom) */ |