rt/snapraid
1
0
Fork 0
mirror of https://github.com/amadvance/snapraid.git synced 2026-10-26 10:51:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject incomplete VPD page 0x80 instead of clamping page_len

Browse source
This commit is contained in:
Andrea Mazzoleni 2026-08-16 15:47:35 +02:00
parent 8707c588a0
commit 712b54ec98
1 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
cmdline/unixapp.c
View file

@ -233,11 +233,15 @@ static int sysattr_vpd_pg80(const char* path, char* dst, size_t dst_size)
/* LCOV_EXCL_STOP */
}
/* clamp to what was actually read */
size_t page_len = ((size_t)buf[2] << 8) | buf[3];
size_t available = (size_t)ret - 4;
if (available < page_len)
page_len = available;
/* if incomplete */
if (page_len > available) {
/* LCOV_EXCL_START */
return -1;
/* LCOV_EXCL_STOP */
}
/* if empty */
if (page_len == 0) {
@ -246,7 +250,7 @@ static int sysattr_vpd_pg80(const char* path, char* dst, size_t dst_size)
/* LCOV_EXCL_STOP */
}
/* if too bit to store the 0 termination */
/* if too big to store the 0 termination */
if (4 + page_len + 1 > sizeof(buf)) {
/* LCOV_EXCL_START */
return -1;
@ -334,7 +338,11 @@ static int sysattr_vpd_pg83(const char* path, char* dst, size_t dst_size)
size_t page_len = ((size_t)buf[2] << 8) | buf[3];
/* clamp to what was actually read */
/*
* Clamp to what was actually read. This is safe because descriptors are
* parsed individually below with strict bounds checking and exact length
* validation, so incomplete or truncated data is never returned.
*/
size_t available = (size_t)ret - 4;
if (page_len > available)
page_len = available;