francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
75 lines
2.8 KiB
Diff
75 lines
2.8 KiB
Diff
From d5bd7cbf26b0254ce068ba7d940c26adbf9ce8e8 Mon Sep 17 00:00:00 2001
|
|
From: Michael Zillgith <michael.zillgith@mz-automation.de>
|
|
Date: Tue, 23 Jul 2024 18:50:15 +0100
|
|
Subject: [PATCH] CVE-2024-45970
|
|
|
|
fixed potential buffer overflows in MMS client file service handling (LIB61850-449)
|
|
|
|
CVE: CVE-2024-45970
|
|
Upstream-Status: Backport [https://github.com/mz-automation/libiec61850/commit/ac925fae8e281ac6defcd630e9dd756264e9c5bc]
|
|
|
|
(cherry picked from commit ac925fae8e281ac6defcd630e9dd756264e9c5bc)
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
src/mms/iso_mms/client/mms_client_files.c | 23 +++++++++++++++++++----
|
|
1 file changed, 19 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/mms/iso_mms/client/mms_client_files.c b/src/mms/iso_mms/client/mms_client_files.c
|
|
index 4fca418e..935ba1a4 100644
|
|
--- a/src/mms/iso_mms/client/mms_client_files.c
|
|
+++ b/src/mms/iso_mms/client/mms_client_files.c
|
|
@@ -487,8 +487,13 @@ parseFileAttributes(uint8_t* buffer, int bufPos, int maxBufPos, uint32_t* fileSi
|
|
break;
|
|
case 0x81: /* lastModified */
|
|
{
|
|
- if (lastModified != NULL) {
|
|
+ if (lastModified != NULL)
|
|
+ {
|
|
char gtString[40];
|
|
+
|
|
+ if (length > sizeof(gtString) - 1)
|
|
+ return false; /* lastModified string too long */
|
|
+
|
|
memcpy(gtString, buffer + bufPos, length);
|
|
gtString[length] = 0;
|
|
*lastModified = Conversions_generalizedTimeToMsTime(gtString);
|
|
@@ -515,12 +520,14 @@ parseDirectoryEntry(uint8_t* buffer, int bufPos, int maxBufPos, uint32_t invokeI
|
|
uint32_t fileSize = 0;
|
|
uint64_t lastModified = 0;
|
|
|
|
- while (bufPos < maxBufPos) {
|
|
+ while (bufPos < maxBufPos)
|
|
+ {
|
|
uint8_t tag = buffer[bufPos++];
|
|
int length;
|
|
|
|
bufPos = BerDecoder_decodeLength(buffer, &length, bufPos, maxBufPos);
|
|
- if (bufPos < 0) {
|
|
+ if (bufPos < 0)
|
|
+ {
|
|
if (DEBUG_MMS_CLIENT)
|
|
printf("MMS_CLIENT: invalid length field\n");
|
|
return false;
|
|
@@ -534,12 +541,20 @@ parseDirectoryEntry(uint8_t* buffer, int bufPos, int maxBufPos, uint32_t invokeI
|
|
tag = buffer[bufPos++];
|
|
|
|
bufPos = BerDecoder_decodeLength(buffer, &length, bufPos, maxBufPos);
|
|
- if (bufPos < 0) {
|
|
+ if (bufPos < 0)
|
|
+ {
|
|
if (DEBUG_MMS_CLIENT)
|
|
printf("MMS_CLIENT: invalid length field\n");
|
|
return false;
|
|
}
|
|
|
|
+ if (length > (sizeof(fileNameMemory) - 1))
|
|
+ {
|
|
+ if (DEBUG_MMS_CLIENT)
|
|
+ printf("MMS_CLIENT: filename too long\n");
|
|
+ return false;
|
|
+ }
|
|
+
|
|
memcpy(filename, buffer + bufPos, length);
|
|
filename[length] = 0;
|
|
|