sven/can-utils
1
0
Fork 0
mirror of https://github.com/linux-can/can-utils.git synced 2026-11-04 07:21:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

isobusfs: srv: pad short Read File responses within the allocated buffer

Browse Source 
The Read File response buffer was allocated for the response header and
the requested data only. Short responses (e.g. count = 0) are extended to
ISOBUSFS_MIN_TRANSFER_LENGH which read beyond the allocated buffer and
sent heap content to the client.

Allocate at least ISOBUSFS_MIN_TRANSFER_LENGH bytes and fill the unused
bytes with 0xff.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
This commit is contained in:
Oliver Hartkopp
2026-10-14 10:21:56 +00:00
parent 33f7ddb5ed
commit d5571a5bc3
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
isobusfs/isobusfs_srv_fa.c
+12 -2
View File
@@ -739,6 +739,7 @@ static int isobusfs_srv_fa_rf_req(struct isobusfs_srv_priv *priv,
uint8_t error_code = 0; uint8_t error_code = 0;
ssize_t send_size; ssize_t send_size;
bool res_allocated = false; bool res_allocated = false;
size_t alloc_size;
size_t max_bytes = 0; size_t max_bytes = 0;
uint16_t count = 0; uint16_t count = 0;
int ret = 0; int ret = 0;
@@ -783,7 +784,12 @@ static int isobusfs_srv_fa_rf_req(struct isobusfs_srv_priv *priv,
max_bytes = count; max_bytes = count;
} }
res = malloc(sizeof(*res) + max_bytes); /* the response is padded to ISOBUSFS_MIN_TRANSFER_LENGH (see below) */
alloc_size = sizeof(*res) + max_bytes;
if (alloc_size < ISOBUSFS_MIN_TRANSFER_LENGH)
alloc_size = ISOBUSFS_MIN_TRANSFER_LENGH;
res = malloc(alloc_size);
if (!res) { if (!res) {
pr_warn("failed to allocate memory"); pr_warn("failed to allocate memory");
res = (struct isobusfs_read_file_response *)&res_fail[0]; res = (struct isobusfs_read_file_response *)&res_fail[0];
@@ -823,8 +829,12 @@ send_response:
res->count = htole16(readed_size); res->count = htole16(readed_size);
send_size = sizeof(*res) + readed_size; send_size = sizeof(*res) + readed_size;
if (send_size < ISOBUSFS_MIN_TRANSFER_LENGH) if (send_size < ISOBUSFS_MIN_TRANSFER_LENGH) {
/* fill the unused bytes with 0xff */
memset((uint8_t *)res + send_size, 0xff,
ISOBUSFS_MIN_TRANSFER_LENGH - send_size);
send_size = ISOBUSFS_MIN_TRANSFER_LENGH; send_size = ISOBUSFS_MIN_TRANSFER_LENGH;
}
/* send to socket */ /* send to socket */
ret = isobusfs_srv_sendto(priv, msg, res, send_size); ret = isobusfs_srv_sendto(priv, msg, res, send_size);