Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-10-04 04:38:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/can/ctucanfd_pci: Stack Overflow When Malformed CAN Data Is Received

Browse source 
A malformed packet can trigger memory corruption in the kernel leading to a
system crash or potentially arbitrary code execution in the kernel.

The CAN driver for the CTU CAN FD IP Core connected to the NuttX device
via a PCI / PCI Express (PCIe) bus shows a lack of consideration for
malformed data, assuming the CAN frames are always correct.

Ensure `frame->fmt.rwcnt` is 21 or less before it is used in the `for` loop.

A similar change was done in ctucanfd_sock_recv().

Tested locally, builds fine.

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This commit is contained in:
Catalin Visinescu 2026-06-14 10:39:01 -04:00 • committed by Mateusz Szafoni
parent 1282b94792
commit ca73f0e9e5
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/can/ctucanfd_pci.c
View file

@ -760,6 +760,14 @@ static void ctucanfd_chardev_receive(FAR struct ctucanfd_can_s *priv)
buff[0] = ctucanfd_getreg(priv, CTUCANFD_RXDATA);
/* buff[0] populated the frame->fmt.rwcnt. Check before use. */
if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]))
{
canerr("ERROR: CAN read/write count is too large. Dropped\n");
return;
}
/* Read the rest of data */
for (i = 0; i < frame->fmt.rwcnt; i++)
@ -1249,6 +1257,14 @@ static FAR netpkt_t *ctucanfd_sock_recv(FAR struct netdev_lowerhalf_s *dev)
buff[0] = ctucanfd_getreg(priv, CTUCANFD_RXDATA);
/* buff[0] populated the frame->fmt.rwcnt. Check before use. */
if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]))
{
canerr("ERROR: CAN read/write count is too large. Dropped\n");
return NULL;
}
/* Read the rest of data */
for (i = 0; i < rxframe->fmt.rwcnt; i++)