fix(security): check array overflowdev

Signed-off-by: sakumisu <[email protected]>

2 files changed, 21 insertions, 2 deletions

diff --git a/class/wireless/usbd_rndis.c b/class/wireless/usbd_rndis.c
index ea62c50e..08366250 100644
--- a/class/wireless/usbd_rndis.c
+++ b/class/wireless/usbd_rndis.c
@@ -477,8 +477,18 @@ void rndis_bulk_out(uint8_t busid, uint8_t ep, uint32_t nbytes)
     (void)busid;
     (void)ep;
 
+    if (nbytes < sizeof(rndis_data_packet_t)) {
+        usbd_rndis_start_read((uint8_t *)g_rndis_rx_data_buffer, g_rndis_rx_total_length);
+        return;
+    }
+
     hdr = (rndis_data_packet_t *)g_rndis_rx_data_buffer;
-    if ((hdr->MessageType != REMOTE_NDIS_PACKET_MSG) || (nbytes < hdr->MessageLength)) {
+    if ((hdr->MessageType != REMOTE_NDIS_PACKET_MSG) ||
+        (hdr->MessageLength < sizeof(rndis_data_packet_t)) ||
+        (hdr->MessageLength > nbytes) ||
+        (hdr->DataOffset < sizeof(rndis_data_packet_t) - sizeof(rndis_generic_msg_t)) ||
+        (hdr->DataOffset > hdr->MessageLength - sizeof(rndis_generic_msg_t)) ||
+        (hdr->DataLength > hdr->MessageLength - sizeof(rndis_generic_msg_t) - hdr->DataOffset)) {
         usbd_rndis_start_read((uint8_t *)g_rndis_rx_data_buffer, g_rndis_rx_total_length);
         return;
     }
@@ -555,6 +565,7 @@ struct pbuf *usbd_rndis_eth_rx(void)
         usbd_rndis_start_read(g_rndis_rx_buffer, sizeof(g_rndis_rx_buffer));
         return NULL;
     }
+
     usb_memcpy(p->payload, (uint8_t *)g_rndis_rx_data_buffer, g_rndis_rx_data_length);
     p->len = g_rndis_rx_data_length;
 
diff --git a/class/wireless/usbh_rndis.c b/class/wireless/usbh_rndis.c
index 22f0e369..d6354d5a 100644
--- a/class/wireless/usbh_rndis.c
+++ b/class/wireless/usbh_rndis.c
@@ -544,6 +544,9 @@ void usbh_rndis_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
             while (g_rndis_rx_length > 0) {
                 USB_LOG_DBG("rxlen:%u\r\n", (unsigned int)g_rndis_rx_length);
 
+                if (g_rndis_rx_length < sizeof(rndis_data_packet_t)) {
+                    break;
+                }
                 pmsg = (rndis_data_packet_t *)(g_rndis_rx_buffer + pmg_offset);
 
                 /* Not word-aligned case */
@@ -552,7 +555,12 @@ void usbh_rndis_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV)
                     pmsg = &temp;
                 }
 
-                if (pmsg->MessageType == REMOTE_NDIS_PACKET_MSG) {
+                if (pmsg->MessageType == REMOTE_NDIS_PACKET_MSG &&
+                    pmsg->MessageLength >= sizeof(rndis_data_packet_t) &&
+                    pmsg->MessageLength <= g_rndis_rx_length &&
+                    pmsg->DataOffset >= sizeof(rndis_data_packet_t) - sizeof(rndis_generic_msg_t) &&
+                    pmsg->DataOffset <= pmsg->MessageLength - sizeof(rndis_generic_msg_t) &&
+                    pmsg->DataLength <= pmsg->MessageLength - sizeof(rndis_generic_msg_t) - pmsg->DataOffset) {
                     uint8_t *buf = (uint8_t *)(g_rndis_rx_buffer + pmg_offset + sizeof(rndis_generic_msg_t) + pmsg->DataOffset);
 
                     usbh_rndis_eth_input(buf, pmsg->DataLength);