usrsock_ioctl_handler() copies req->arglen bytes from the request
payload into the fixed-size usrsock->out buffer without validating
that the payload fits either the received request or the destination
buffer. This is the same class of vulnerability as the one already
fixed in nrf91_modem_sock.c (commit a43fb69283).
Add three checks before the copy:
- len >= sizeof(*req): ensure the full request header is present.
- copylen <= len - sizeof(*req): payload must fit the received data.
- copylen <= SIM_USRSOCK_BUFSIZE - sizeof(*ack): payload must fit
the destination buffer.
Signed-off-by: hanzj <hanzjian@zepp.com>
9aada7f9ae