fix(security): check array overflowdev

Signed-off-by: sakumisu <[email protected]>

2 files changed, 20 insertions, 5 deletions

diff --git a/class/vendor/net/usbh_asix.c b/class/vendor/net/usbh_asix.c
index e63b274b..706b5c9c 100644
--- a/class/vendor/net/usbh_asix.c
+++ b/class/vendor/net/usbh_asix.c
@@ -718,10 +718,13 @@ void usbh_asix_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
 
             data_offset = 0;
             while (g_asix_rx_length > 0) {
+                if (g_asix_rx_length < 4) {
+                    break;
+                }
                 len = ((uint16_t)g_asix_rx_buffer[data_offset + 0] | ((uint16_t)(g_asix_rx_buffer[data_offset + 1]) << 8)) & 0x7ff;
                 len_crc = g_asix_rx_buffer[data_offset + 2] | ((uint16_t)(g_asix_rx_buffer[data_offset + 3]) << 8);
 
-                if (len != (~len_crc & 0x7ff)) {
+                if (len != (~len_crc & 0x7ff) || len == 0 || (len > g_asix_rx_length - 4)) {
                     USB_LOG_ERR("rx header error\r\n");
                     g_asix_rx_length = 0;
                     continue;
@@ -732,8 +735,9 @@ void usbh_asix_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
                 g_asix_rx_length -= (len + 4);
                 data_offset += (len + 4);
 
-                if (g_asix_rx_length < 4) {
-                    g_asix_rx_length = 0;
+                if ((len & 1) && g_asix_rx_length > 0) {
+                    g_asix_rx_length--;
+                    data_offset++;
                 }
             }
         } else {
diff --git a/class/vendor/net/usbh_rtl8152.c b/class/vendor/net/usbh_rtl8152.c
index 16393ab1..df5f3d3b 100644
--- a/class/vendor/net/usbh_rtl8152.c
+++ b/class/vendor/net/usbh_rtl8152.c
@@ -2186,9 +2186,16 @@ void usbh_rtl8152_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
 
             USB_LOG_DBG("rxlen:%d\r\n", g_rtl8152_rx_length);
             while (g_rtl8152_rx_length > 0) {
+                if (g_rtl8152_rx_length < sizeof(struct rx_desc)) {
+                    break;
+                }
                 struct rx_desc *rx_desc = (struct rx_desc *)&g_rtl8152_rx_buffer[data_offset];
 
                 len = rx_desc->opts1 & RX_LEN_MASK;
+                if (len == 0 || len > g_rtl8152_rx_length - sizeof(struct rx_desc)) {
+                    USB_LOG_ERR("invalid rtl8152 rx length\r\n");
+                    break;
+                }
 
                 USB_LOG_DBG("data_offset:%d, eth len:%d\r\n", data_offset, len);
 
@@ -2199,8 +2206,12 @@ void usbh_rtl8152_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
                 g_rtl8152_rx_length -= (len + sizeof(struct rx_desc));
 
                 if (len & (RX_ALIGN - 1)) {
-                    data_offset += (RX_ALIGN - (len & (RX_ALIGN - 1)));
-                    g_rtl8152_rx_length -= (RX_ALIGN - (len & (RX_ALIGN - 1)));
+                    uint32_t padding = RX_ALIGN - (len & (RX_ALIGN - 1));
+                    if (padding > g_rtl8152_rx_length) {
+                        break;
+                    }
+                    data_offset += padding;
+                    g_rtl8152_rx_length -= padding;
                 }
             }
         } else {