From d5571a5bc346483fa3ca8a1b49439430b223d335 Mon Sep 17 00:00:00 2001 From: Oliver Hartkopp Date: Wed, 14 Oct 2026 09:54:43 +0000 Subject: [PATCH] isobusfs: srv: pad short Read File responses within the allocated buffer The Read File response buffer was allocated for the response header and the requested data only. Short responses (e.g. count = 0) are extended to ISOBUSFS_MIN_TRANSFER_LENGH which read beyond the allocated buffer and sent heap content to the client. Allocate at least ISOBUSFS_MIN_TRANSFER_LENGH bytes and fill the unused bytes with 0xff. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Oliver Hartkopp --- isobusfs/isobusfs_srv_fa.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/isobusfs/isobusfs_srv_fa.c b/isobusfs/isobusfs_srv_fa.c index a106d38..d48aa59 100644 --- a/isobusfs/isobusfs_srv_fa.c +++ b/isobusfs/isobusfs_srv_fa.c @@ -739,6 +739,7 @@ static int isobusfs_srv_fa_rf_req(struct isobusfs_srv_priv *priv, uint8_t error_code = 0; ssize_t send_size; bool res_allocated = false; + size_t alloc_size; size_t max_bytes = 0; uint16_t count = 0; int ret = 0; @@ -783,7 +784,12 @@ static int isobusfs_srv_fa_rf_req(struct isobusfs_srv_priv *priv, max_bytes = count; } - res = malloc(sizeof(*res) + max_bytes); + /* the response is padded to ISOBUSFS_MIN_TRANSFER_LENGH (see below) */ + alloc_size = sizeof(*res) + max_bytes; + if (alloc_size < ISOBUSFS_MIN_TRANSFER_LENGH) + alloc_size = ISOBUSFS_MIN_TRANSFER_LENGH; + + res = malloc(alloc_size); if (!res) { pr_warn("failed to allocate memory"); res = (struct isobusfs_read_file_response *)&res_fail[0]; @@ -823,8 +829,12 @@ send_response: res->count = htole16(readed_size); send_size = sizeof(*res) + readed_size; - if (send_size < ISOBUSFS_MIN_TRANSFER_LENGH) + if (send_size < ISOBUSFS_MIN_TRANSFER_LENGH) { + /* fill the unused bytes with 0xff */ + memset((uint8_t *)res + send_size, 0xff, + ISOBUSFS_MIN_TRANSFER_LENGH - send_size); send_size = ISOBUSFS_MIN_TRANSFER_LENGH; + } /* send to socket */ ret = isobusfs_srv_sendto(priv, msg, res, send_size);