fix blob parsing vulnerability by using blob_parse_untrusted

[project/ubus.git] / libubus-io.c

diff --git a/libubus-io.c b/libubus-io.c
index cdd1e6e1ed6a63a6bdcd2f0a6926c6b0d59eabf3..ba1016d0fa09b5cd7081209545f6a34e7104c853 100644 (file)
--- a/libubus-io.c
+++ b/libubus-io.c
@@ -43,9 +43,9 @@ static const struct blob_attr_info ubus_policy[UBUS_ATTR_MAX] = {
 
 static struct blob_attr *attrbuf[UBUS_ATTR_MAX];
 
-__hidden struct blob_attr **ubus_parse_msg(struct blob_attr *msg)
+__hidden struct blob_attr **ubus_parse_msg(struct blob_attr *msg, size_t len)
 {
-       blob_parse(msg, attrbuf, ubus_policy, UBUS_ATTR_MAX);
+       blob_parse_untrusted(msg, len, attrbuf, ubus_policy, UBUS_ATTR_MAX);
        return attrbuf;
 }
 
@@ -78,7 +78,7 @@ static int writev_retry(int fd, struct iovec *iov, int iov_len, int sock_fd)
        int len = 0;
 
        do {
-               int cur_len;
+               ssize_t cur_len;
 
                if (sock_fd < 0) {
                        msghdr.msg_control = NULL;
@@ -105,7 +105,7 @@ static int writev_retry(int fd, struct iovec *iov, int iov_len, int sock_fd)
                        sock_fd = -1;
 
                len += cur_len;
-               while (cur_len >= iov->iov_len) {
+               while (cur_len >= (ssize_t) iov->iov_len) {
                        cur_len -= iov->iov_len;
                        iov_len--;
                        iov++;
@@ -215,7 +215,7 @@ static int recv_retry(struct ubus_context *ctx, struct iovec *iov, bool wait, in
        return total;
 }
 
-static bool ubus_validate_hdr(struct ubus_msghdr *hdr)
+bool ubus_validate_hdr(struct ubus_msghdr *hdr)
 {
        struct blob_attr *data = (struct blob_attr *) (hdr + 1);
 
@@ -392,7 +392,7 @@ int ubus_reconnect(struct ubus_context *ctx, const char *path)
                goto out_close;
 
        memcpy(buf, &hdr.data, sizeof(hdr.data));
-       if (read(ctx->sock.fd, blob_data(buf), blob_len(buf)) != blob_len(buf))
+       if (read(ctx->sock.fd, blob_data(buf), blob_len(buf)) != (ssize_t) blob_len(buf))
                goto out_free;
 
        ctx->local_id = hdr.hdr.peer;