From 02ffd90a9fbc71a126bb9633686150b0a6399b19 Mon Sep 17 00:00:00 2001 From: Javid Khan Date: Sat, 27 Jun 2026 23:22:24 +0530 Subject: bound ndp16 wLength against received ntb in recv_validate_datagram --- src/class/net/ncm_device.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src') diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c index e5f441300..df17c217a 100644 --- a/src/class/net/ncm_device.c +++ b/src/class/net/ncm_device.c @@ -633,6 +633,12 @@ static bool recv_validate_datagram(const recv_ntb_t *ntb, uint32_t len) { TU_LOG_DRV("(EE) ill ndp16 length: %d\n", ndp16->wLength); return false; } + // the NDP block (wLength bytes from wNdpIndex) must fit within the received NTB, otherwise the + // datagram pointer array walked below (max_ndx is derived from wLength) runs past ntb->data + if ((uint32_t) nth16->wNdpIndex + ndp16->wLength > len) { + TU_LOG_DRV("(EE) ill ndp16 length: %d (%lu)\n", ndp16->wLength, len); + return false; + } if (ndp16->dwSignature != NDP16_SIGNATURE_NCM0 && ndp16->dwSignature != NDP16_SIGNATURE_NCM1) { TU_LOG_DRV("(EE) ill signature: 0x%08x\n", (unsigned) ndp16->dwSignature); return false; -- cgit v1.3.1