libbladeRF: fix buffer overflows and a missing NULL check in gain calibration - #1074
Open
wormuz wants to merge 1 commit into
Open
libbladeRF: fix buffer overflows and a missing NULL check in gain calibration#1074wormuz wants to merge 1 commit into
wormuz wants to merge 1 commit into
Conversation
|
|
…ibration Three issues in the gain calibration paths added in 2.6.0: device_calibration.c: strcat() appends a caller-supplied CSV path of arbitrary length to a 1000-byte buffer that already holds the working directory. Long paths overflow the stack buffer. Print both parts with a format specifier instead of concatenating in place. bladerf.c: strcpy() copies a caller-supplied calibration path into a PATH_MAX buffer without a length check. Reject paths that do not fit. bladerf.c: malloc() result used by strcpy() without a NULL check. All three are reachable through bladerf_load_gain_calibration() with a caller-controlled path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three issues in the gain calibration paths added in 2.6.0, all reachable through
bladerf_load_gain_calibration()with a caller-controlled path:device_calibration.c—strcat()appends a caller-supplied CSV path of arbitrary length to a 1000-byte buffer that already holds the working directory. Long paths overflow the stack buffer. Fixed by printing both parts with a format specifier instead of concatenating in place.bladerf.c—strcpy()copies a caller-supplied calibration path into aPATH_MAXbuffer without a length check. Fixed by rejecting paths that do not fit.bladerf.c—malloc()result passed tostrcpy()without a NULL check.Found while auditing the 2.6.0 changes against a bladeRF 2.0 micro xA4.