Ensure blob_attr length check does not perform out of bounds reads

[project/libubox.git] / blob.h

diff --git a/blob.h b/blob.h
index af033607e309a76ad9987c2d5c3ba661a6947fa1..6d618767b91af92a0a4184e0236db757f90c3ab9 100644 (file)
--- a/blob.h
+++ b/blob.h
@@ -243,7 +243,7 @@ blob_put_u64(struct blob_buf *buf, int id, uint64_t val)
 
 #define __blob_for_each_attr(pos, attr, rem) \
        for (pos = (struct blob_attr *) attr; \
-            rem > 0 && (blob_pad_len(pos) <= rem) && \
+            rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
             (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
             rem -= blob_pad_len(pos), pos = blob_next(pos))
 
@@ -251,7 +251,7 @@ blob_put_u64(struct blob_buf *buf, int id, uint64_t val)
 #define blob_for_each_attr(pos, attr, rem) \
        for (rem = attr ? blob_len(attr) : 0, \
             pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \
-            rem > 0 && (blob_pad_len(pos) <= rem) && \
+            rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
             (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
             rem -= blob_pad_len(pos), pos = blob_next(pos))