Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-30 13:43:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
nuttx/arch/sim/src
History
hanzj 94fa220650 arch/sim: Fix OOB read/write in usrsock_ioctl_handler 
usrsock_ioctl_handler() copies req->arglen bytes from the request
payload into the fixed-size usrsock->out buffer without validating
that the payload fits either the received request or the destination
buffer.  This is the same class of vulnerability as the one already
fixed in nrf91_modem_sock.c (commit a43fb69283).

Add three checks before the copy:

  - len >= sizeof(*req): ensure the full request header is present.
  - copylen <= len - sizeof(*req): payload must fit the received data.
  - copylen <= SIM_USRSOCK_BUFSIZE - sizeof(*ack): payload must fit
    the destination buffer.

Signed-off-by: hanzj <hanzjian@zepp.com>
2026-06-02 00:08:22 +08:00
..
cmake tools/rust: Fix aarch64 NuttX Rust target specs 2026-05-29 10:25:10 +02:00
sim arch/sim: Fix OOB read/write in usrsock_ioctl_handler 2026-06-02 00:08:22 +08:00
.gitignore arch/sim: Copy include/nuttx/config.h to the local folder 2021-07-27 07:44:33 +09:00
CMakeLists.txt cmake:add missing cflag "-D_FILE_OFFSET_BITS=64" of sim 2025-12-18 22:18:49 +08:00
Makefile arch/sim: replace macOS C++ constructor runtime hack with post-link patch 2026-05-19 07:08:55 -03:00
nuttx-names.in arch/sim: rename nuttx libc memchr to avoid host glibc collision 2026-05-18 13:12:48 +08:00
patch_macho_initsection.py arch/sim: replace macOS C++ constructor runtime hack with post-link patch 2026-05-19 07:08:55 -03:00