From d23c3e4c28f21b2f6543747d62e289ed4085458f Mon Sep 17 00:00:00 2001 From: Filipe Brandenburger Date: Thu, 7 Jun 2018 13:46:32 -0700 Subject: [PATCH] lldp: check that lldp neighbor raw data size is in expected range This fixes an insecure use of tainted data as argument to functions that allocate memory and read from files, which could be tricked into getting networkctl to allocate a large amount of memory and fill it with file data. This was uncovered by Coverity. Fixes CID 1393254. --- src/network/networkctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/network/networkctl.c b/src/network/networkctl.c index 29899a9..ccfab40 100644 --- a/src/network/networkctl.c +++ b/src/network/networkctl.c @@ -636,6 +636,10 @@ static int next_lldp_neighbor(FILE *f, sd_lldp_neighbor **ret) { if (l != sizeof(u)) return -EBADMSG; + /* each LLDP packet is at most MTU size, but let's allow up to 4KiB just in case */ + if (le64toh(u) >= 4096) + return -EBADMSG; + raw = new(uint8_t, le64toh(u)); if (!raw) return -ENOMEM; -- 2.7.4