sven/can-utils
1
0
Fork 0
mirror of https://github.com/linux-can/can-utils.git synced 2026-11-04 15:31:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

isobusfs: srv: check name length against the received message length

Browse Source 
The Change Current Directory and Volume Status requests used the path
and volume name length from the request without checking it against
the received message length. Short messages with a big name length made
the server process stale content of the receive buffer as path or
volume name.

Check the name length against the message length, use le16toh() for the
CCD name length and fix the debug output of the volume name.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
This commit is contained in:
Oliver Hartkopp
2026-10-14 10:21:56 +00:00
parent d5571a5bc3
commit 13dc8e9cc5
2 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
isobusfs/isobusfs_srv_cm.c
+9 -2
View File
@@ -20,6 +20,7 @@
*/
#include <errno.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
@@ -473,8 +474,14 @@ static int isobusfs_srv_process_volume_status_request(struct isobusfs_srv_priv *
req_name_len = le16toh(req->name_len);
pr_debug("< rx volume status request. mode: %x, length: %d, name: %s",
req->volume_mode, req_name_len, req->name);
/* the volume name has to fit into the received message */
if (req_name_len > msg->len - offsetof(struct isobusfs_cm_vol_stat_req, name)) {
pr_warn("volume name length exceeds message length");
return ISOBUSFS_ERR_MALFORMED_REQUEST;
}
pr_debug("< rx volume status request. mode: %x, length: %zu, name: %.*s",
req->volume_mode, req_name_len, (int)req_name_len, req->name);
client = isobusfs_srv_get_client_by_msg(priv, msg);
if (!client) {