Skip to content

ubusd: fix buffer overflow on invalid socket input

Erik Karlsson - Genexis requested to merge (removed):ubusd-buffer-overflow into devel

When invalid input is received, for example all zeroes, the value of the length field of the blob header can smaller than the size of the header itself. This was leading to allocation of too small buffer and the header being written beyond its end, resulting in heap corruption and crash on upcoming free() call. Handle this by rejecting the connection when invalid length is received.

Merge request reports