Skip to content

Commit eaff818

Browse files
committed
fix: restore description_length cap in V2 register_application and register_context
The DLTv2 IPC registration handlers have their description_length sanity guards commented out, while the equivalent V1 code paths apply them correctly. This allows an attacker-controlled description_length (uint32) to be passed directly to dlt_receiver_check_and_get, which calls memcpy into a 257-byte stack buffer (description[DLT_DAEMON_DESCSIZE + 1]), causing a stack buffer overflow. Uncomment the existing guards in both V2 code paths to clamp description_length to DLT_DAEMON_DESCSIZE (256). Affected functions: - dlt_daemon_process_user_message_register_application (V2 branch, ~line 4012) - dlt_daemon_process_user_message_register_context (V2 branch, ~line 4301) Signed-off-by: Ian Chu <ian_chu@vicone.com>
1 parent fd1fbf8 commit eaff818

1 file changed

Lines changed: 8 additions & 8 deletions

File tree

src/daemon/dlt-daemon.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4009,10 +4009,10 @@ int dlt_daemon_process_user_message_register_application(DltDaemon *daemon,
40094009

40104010
len = usercontext.description_length;
40114011

4012-
// if (len > DLT_DAEMON_DESCSIZE) {
4013-
// len = DLT_DAEMON_DESCSIZE;
4014-
// dlt_log(LOG_WARNING, "Application description exceeds limit\n");
4015-
// }
4012+
if (len > DLT_DAEMON_DESCSIZE) {
4013+
len = DLT_DAEMON_DESCSIZE;
4014+
dlt_log(LOG_WARNING, "Application description exceeds limit\n");
4015+
}
40164016

40174017
/* adjust buffer pointer */
40184018
rec->buf += to_remove + sizeof(DltUserHeader);
@@ -4298,10 +4298,10 @@ int dlt_daemon_process_user_message_register_context(DltDaemon *daemon,
42984298

42994299
len = usercontext.description_length;
43004300

4301-
// if (len > DLT_DAEMON_DESCSIZE) {
4302-
// dlt_vlog(LOG_WARNING, "Context description exceeds limit: %u\n", len);
4303-
// len = DLT_DAEMON_DESCSIZE;
4304-
// }
4301+
if (len > DLT_DAEMON_DESCSIZE) {
4302+
dlt_vlog(LOG_WARNING, "Context description exceeds limit: %u\n", len);
4303+
len = DLT_DAEMON_DESCSIZE;
4304+
}
43054305

43064306
/* adjust buffer pointer */
43074307
rec->buf += to_remove + sizeof(DltUserHeader);

0 commit comments

Comments
 (0)