aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorRichard Weinberger2023-07-20 14:51:56 +0200
committerTom Rini2023-09-22 13:58:51 -0400
commita8bd5ec00022cc6cf790b766abaa9c4f6c850add (patch)
tree66a8784dabef2c4a18313ea3f61d784bd4bc4888 /net
parentd01a8541d62d78ad76706617e9f8690c8cb01fb8 (diff)
net: wget: Avoid packet queue overflow
Make sure to stay within bounds, as a misbehaving HTTP server can trigger a buffer overflow if not properly handled. Cc: Joe Hershberger <joe.hershberger@ni.com> Cc: Ramon Fried <rfried.dev@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'net')
-rw-r--r--net/wget.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/net/wget.c b/net/wget.c
index 2dbfeb1a1d5..8bb4d72db1a 100644
--- a/net/wget.c
+++ b/net/wget.c
@@ -35,7 +35,8 @@ struct pkt_qd {
* The actual packet bufers are in the kernel space, and are
* expected to be overwritten by the downloaded image.
*/
-static struct pkt_qd pkt_q[PKTBUFSRX / 4];
+#define PKTQ_SZ (PKTBUFSRX / 4)
+static struct pkt_qd pkt_q[PKTQ_SZ];
static int pkt_q_idx;
static unsigned long content_length;
static unsigned int packets;
@@ -202,6 +203,13 @@ static void wget_connected(uchar *pkt, unsigned int tcp_seq_num,
pkt_q[pkt_q_idx].tcp_seq_num = tcp_seq_num;
pkt_q[pkt_q_idx].len = len;
pkt_q_idx++;
+
+ if (pkt_q_idx >= PKTQ_SZ) {
+ printf("wget: Fatal error, queue overrun!\n");
+ net_set_state(NETLOOP_FAIL);
+
+ return;
+ }
} else {
debug_cond(DEBUG_WGET, "wget: Connected HTTP Header %p\n", pkt);
/* sizeof(http_eom) - 1 is the string length of (http_eom) */