diff options
| author | Tom Rini <[email protected]> | 2025-03-03 07:47:13 -0600 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2025-03-03 07:47:37 -0600 |
| commit | d4e428856cfa701ae6ad012c150c3f5c8e19c044 (patch) | |
| tree | ed1b3d412cbaff5569f13334bb5ea83e7dd21f15 /net | |
| parent | 6ae0a578de67038df291a5fea3e7ab67cc520680 (diff) | |
| parent | 32a6c5eac0004bcfbb75d7ff9e9d627aca0e2852 (diff) | |
Merge tag 'efi-2025-04-rc4' of https://source.denx.de/u-boot/custodians/u-boot-efi
CI:
* https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/24904
UEFI:
* Let efi_net_set_dp properly update the device path
Network:
* Avoid buffer overflows in wget_info with legacy TCP stack
Diffstat (limited to 'net')
| -rw-r--r-- | net/wget.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/net/wget.c b/net/wget.c index 0b082c61947..c73836cbc9d 100644 --- a/net/wget.c +++ b/net/wget.c @@ -53,6 +53,9 @@ static inline int store_block(uchar *src, unsigned int offset, unsigned int len) ulong store_addr = image_load_addr + offset; uchar *ptr; + // Avoid overflow + if (wget_info->buffer_size && wget_info->buffer_size < offset + len) + return -1; if (CONFIG_IS_ENABLED(LMB) && wget_info->set_bootdev) { if (store_addr < image_load_addr || lmb_read_check(store_addr, len)) { @@ -98,12 +101,6 @@ static void tcp_stream_on_closed(struct tcp_stream *tcp) net_set_state(wget_loop_state); if (wget_loop_state != NETLOOP_SUCCESS) { net_boot_file_size = 0; - if (wget_info->status_code == HTTP_STATUS_OK) { - wget_info->status_code = HTTP_STATUS_BAD; - wget_info->hdr_cont_len = 0; - if (wget_info->headers) - wget_info->headers[0] = 0; - } printf("\nwget: Transfer Fail, TCP status - %d\n", tcp->status); return; } @@ -212,6 +209,11 @@ static void tcp_stream_on_rcv_nxt_update(struct tcp_stream *tcp, u32 rx_bytes) "wget: Connected Len %lu\n", content_length); wget_info->hdr_cont_len = content_length; + if (wget_info->buffer_size && wget_info->buffer_size < wget_info->hdr_cont_len){ + tcp_stream_reset(tcp); + goto end; + } + } net_boot_file_size = rx_bytes - http_hdr_size; @@ -227,7 +229,9 @@ static int tcp_stream_rx(struct tcp_stream *tcp, u32 rx_offs, void *buf, int len if ((max_rx_pos == (u32)(-1)) || (max_rx_pos < rx_offs + len - 1)) max_rx_pos = rx_offs + len - 1; - store_block(buf, rx_offs - http_hdr_size, len); + // Avoid overflow + if (store_block(buf, rx_offs - http_hdr_size, len) < 0) + return -1; return len; } |