MIME-Version: 1.0
In-Reply-To: <20150526135635.GH11588@mwanda>
References: <1431543500-4847-1-git-send-email-Jason@zx2c4.com>
	<1432642669-7289-1-git-send-email-Jason@zx2c4.com>
	<1432642669-7289-2-git-send-email-Jason@zx2c4.com>
	<20150526133221.GG11588@mwanda>
	<CAHmME9oLLKUxm4zk_=kzRAt5Key_G0+dgozVVw+EwUcYJYDRmg@mail.gmail.com>
	<20150526135635.GH11588@mwanda>
Date: Tue, 26 May 2015 16:58:26 +0200
Message-ID: <CAHmME9qk2w+A_SPs5NoBRXWV+9N3TMzbp7eMSiiherHWQGLz+g@mail.gmail.com>
Subject: Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1010
Lines: 19

On Tue, May 26, 2015 at 3:56 PM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
>> elt->length is a u8, so the upper bound is 255.
>
> Yes.  I know that, but is 255 correct?

Eventually body->data is passed to oz_hcd_get_desc_cnf along with
data_len. In there, body->data (now called desc) is memcpy'd into a
URB transfer buffer. The checks to see if that transfer buffer is big
enough are broken and vulnerable, and another patch in this set
addresses that. But anyway, AFAIK, the 255 limit works fine for all
subsequent types used, after this patch set is applied. The use of a
u8 cannot, at this point, be *increased* since this protocol is tied
to particular hardware chips sold by Atmel/Ozmo. And I can't see a
reason why it should be further bounded either.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/