mirror/tinyusb
3
0
Fork 0
mirror of https://github.com/hathach/tinyusb.git synced 2026-08-18 11:02:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

bound ndp16 wLength against received ntb in recv_validate_datagram

Browse Source
This commit is contained in:
Javid Khan
2026-06-27 23:22:24 +05:30
parent ca8a74fa93
commit 02ffd90a9f
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/class/net/ncm_device.c
View File

@ -633,6 +633,12 @@ static bool recv_validate_datagram(const recv_ntb_t *ntb, uint32_t len) {
TU_LOG_DRV("(EE) ill ndp16 length: %d\n", ndp16->wLength);
return false;
}
// the NDP block (wLength bytes from wNdpIndex) must fit within the received NTB, otherwise the
// datagram pointer array walked below (max_ndx is derived from wLength) runs past ntb->data
if ((uint32_t) nth16->wNdpIndex + ndp16->wLength > len) {
TU_LOG_DRV("(EE) ill ndp16 length: %d (%lu)\n", ndp16->wLength, len);
return false;
}
if (ndp16->dwSignature != NDP16_SIGNATURE_NCM0 && ndp16->dwSignature != NDP16_SIGNATURE_NCM1) {
TU_LOG_DRV("(EE) ill signature: 0x%08x\n", (unsigned) ndp16->dwSignature);
return false;