fix(security): check array overflowdev

Signed-off-by: sakumisu <[email protected]>

2 files changed, 33 insertions, 10 deletions

diff --git a/class/vendor/net/usbh_asix.c b/class/vendor/net/usbh_asix.c
index e63b274b..4e711f3a 100644
--- a/class/vendor/net/usbh_asix.c
+++ b/class/vendor/net/usbh_asix.c
@@ -718,10 +718,13 @@ void usbh_asix_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
 
             data_offset = 0;
             while (g_asix_rx_length > 0) {
+                if (g_asix_rx_length < 4) {
+                    break;
+                }
                 len = ((uint16_t)g_asix_rx_buffer[data_offset + 0] | ((uint16_t)(g_asix_rx_buffer[data_offset + 1]) << 8)) & 0x7ff;
                 len_crc = g_asix_rx_buffer[data_offset + 2] | ((uint16_t)(g_asix_rx_buffer[data_offset + 3]) << 8);
 
-                if (len != (~len_crc & 0x7ff)) {
+                if (len != (~len_crc & 0x7ff) || len == 0 || (len > g_asix_rx_length - 4)) {
                     USB_LOG_ERR("rx header error\r\n");
                     g_asix_rx_length = 0;
                     continue;
@@ -732,8 +735,9 @@ void usbh_asix_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
                 g_asix_rx_length -= (len + 4);
                 data_offset += (len + 4);
 
-                if (g_asix_rx_length < 4) {
-                    g_asix_rx_length = 0;
+                if ((len & 1) && g_asix_rx_length > 0) {
+                    g_asix_rx_length--;
+                    data_offset++;
                 }
             }
         } else {
@@ -760,17 +764,21 @@ int usbh_asix_eth_output(uint32_t buflen)
         return -USB_ERR_NOTCONN;
     }
 
+    if ((buflen + 8) > sizeof(g_asix_tx_buffer)) {
+        return -USB_ERR_NOMEM;
+    }
+
     g_asix_tx_buffer[0] = buflen & 0xff;
     g_asix_tx_buffer[1] = (buflen >> 8) & 0xff;
     g_asix_tx_buffer[2] = ~g_asix_tx_buffer[0];
     g_asix_tx_buffer[3] = ~g_asix_tx_buffer[1];
 
-    if (!(buflen + 4) % USB_GET_MAXPACKETSIZE(g_asix_class.bulkout->wMaxPacketSize)) {
+    if (((buflen + 4U) % USB_GET_MAXPACKETSIZE(g_asix_class.bulkout->wMaxPacketSize)) == 0U) {
         USB_LOG_DBG("txlen:%d\r\n", buflen + 8);
-        g_asix_tx_buffer[buflen + 4 + 0] = 0x00;
-        g_asix_tx_buffer[buflen + 4 + 1] = 0x00;
-        g_asix_tx_buffer[buflen + 4 + 2] = 0xff;
-        g_asix_tx_buffer[buflen + 4 + 3] = 0xff;
+        g_asix_tx_buffer[buflen + 4] = 0x00;
+        g_asix_tx_buffer[buflen + 5] = 0x00;
+        g_asix_tx_buffer[buflen + 6] = 0xff;
+        g_asix_tx_buffer[buflen + 7] = 0xff;
         actual_len = buflen + 8;
     } else {
         USB_LOG_DBG("txlen:%d\r\n", buflen + 4);
diff --git a/class/vendor/net/usbh_rtl8152.c b/class/vendor/net/usbh_rtl8152.c
index 16393ab1..079d4e2f 100644
--- a/class/vendor/net/usbh_rtl8152.c
+++ b/class/vendor/net/usbh_rtl8152.c
@@ -2186,9 +2186,16 @@ void usbh_rtl8152_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
 
             USB_LOG_DBG("rxlen:%d\r\n", g_rtl8152_rx_length);
             while (g_rtl8152_rx_length > 0) {
+                if (g_rtl8152_rx_length < sizeof(struct rx_desc)) {
+                    break;
+                }
                 struct rx_desc *rx_desc = (struct rx_desc *)&g_rtl8152_rx_buffer[data_offset];
 
                 len = rx_desc->opts1 & RX_LEN_MASK;
+                if (len == 0 || len > g_rtl8152_rx_length - sizeof(struct rx_desc)) {
+                    USB_LOG_ERR("invalid rtl8152 rx length\r\n");
+                    break;
+                }
 
                 USB_LOG_DBG("data_offset:%d, eth len:%d\r\n", data_offset, len);
 
@@ -2199,8 +2206,12 @@ void usbh_rtl8152_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
                 g_rtl8152_rx_length -= (len + sizeof(struct rx_desc));
 
                 if (len & (RX_ALIGN - 1)) {
-                    data_offset += (RX_ALIGN - (len & (RX_ALIGN - 1)));
-                    g_rtl8152_rx_length -= (RX_ALIGN - (len & (RX_ALIGN - 1)));
+                    uint32_t padding = RX_ALIGN - (len & (RX_ALIGN - 1));
+                    if (padding > g_rtl8152_rx_length) {
+                        break;
+                    }
+                    data_offset += padding;
+                    g_rtl8152_rx_length -= padding;
                 }
             }
         } else {
@@ -2227,6 +2238,10 @@ int usbh_rtl8152_eth_output(uint32_t buflen)
         return -USB_ERR_NOTCONN;
     }
 
+    if ((buflen + sizeof(struct tx_desc)) > sizeof(g_rtl8152_tx_buffer)) {
+        return -USB_ERR_NOMEM;
+    }
+
     tx_desc = (struct tx_desc *)g_rtl8152_tx_buffer;
     tx_desc->opts1 = buflen | TX_FS | TX_LS;
     tx_desc->opts2 = 0;