hanzj 94fa220650 arch/sim: Fix OOB read/write in usrsock_ioctl_handler ... usrsock_ioctl_handler() copies req->arglen bytes from the request payload into the fixed-size usrsock->out buffer without validating that the payload fits either the received request or the destination buffer. This is the same class of vulnerability as the one already fixed in nrf91_modem_sock.c (commit a43fb69283). Add three checks before the copy: - len >= sizeof(*req): ensure the full request header is present. - copylen <= len - sizeof(*req): payload must fit the received data. - copylen <= SIM_USRSOCK_BUFSIZE - sizeof(*ack): payload must fit the destination buffer. Signed-off-by: hanzj <hanzjian@zepp.com>		2026-06-02 00:08:22 +08:00
..
include	arch/sim: replace macOS C++ constructor runtime hack with post-link patch	2026-05-19 07:08:55 -03:00
src	arch/sim: Fix OOB read/write in usrsock_ioctl_handler	2026-06-02 00:08:22 +08:00
CMakeLists.txt	arch:use ARCH_64BIT to mark arch is support 64bit	2025-12-18 22:05:12 +08:00
Kconfig	sim: adapt macos avfoundation backend for camera indexing and capture	2026-05-08 19:51:39 +08:00