PR https://github.com/apache/nuttx/pull/19139 addresses the issue, but there
is one minor problem. In the for loop the element `i+1` is written which
means there can still be an overflow by one element (uint32_t or 4 bytes).
Addressing here with this PR.
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
The function seek which allows the user to move the cursor to a particular
offset in order to read and write from EEPROM storage does not validate the
offset is valid. Later, this can cause an out-of-bounds reads or writes.
Note that newpos may store a large value, larger than the size of the EEPROM.
Similar change in the SPI driver.
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
When calling Set RF Configuration command, a compromised user
process can trigger memory corruption in the kernel. This can
lead to a system crash or potentially arbitrary code execution
in the kernel.
It addresses an earlier incomplete fix.
Tested locally.
Signed-off-by: Your Name <catalin_visinescu@yahoo.com>
A malformed packet can trigger memory corruption in the kernel leading to a
system crash or potentially arbitrary code execution in the kernel.
The CAN driver for the CTU CAN FD IP Core connected to the NuttX device
via a PCI / PCI Express (PCIe) bus shows a lack of consideration for
malformed data, assuming the CAN frames are always correct.
Ensure `frame->fmt.rwcnt` is 21 or less before it is used in the `for` loop.
A similar change was done in ctucanfd_sock_recv().
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Catalin VisinescuandXiang Xiao