Blame SOURCES/Fixed-missing-input-buffer-length-check-in-urbdrc.patch

087af1
From ddf9b3f852c31311f8d726012131f657c9857276 Mon Sep 17 00:00:00 2001
087af1
From: akallabeth <akallabeth@posteo.net>
087af1
Date: Thu, 13 Oct 2022 08:47:51 +0200
087af1
Subject: [PATCH] Fixed missing input buffer length check in urbdrc
087af1
087af1
(cherry picked from commit 497df00f741dd4fc89292aaef2db7368aee45d0d)
087af1
---
087af1
 channels/urbdrc/client/data_transfer.c | 20 ++++++++++++++++++++
087af1
 1 file changed, 20 insertions(+)
087af1
087af1
diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
087af1
index bb2784055..80e84af48 100644
087af1
--- a/channels/urbdrc/client/data_transfer.c
087af1
+++ b/channels/urbdrc/client/data_transfer.c
087af1
@@ -241,6 +241,10 @@ static UINT urbdrc_process_io_control(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* c
087af1
 
087af1
 	Stream_Read_UINT32(s, OutputBufferSize);
087af1
 	Stream_Read_UINT32(s, RequestId);
087af1
+
087af1
+	if (OutputBufferSize > UINT32_MAX - 4)
087af1
+		return ERROR_INVALID_DATA;
087af1
+
087af1
 	InterfaceId = ((STREAM_ID_PROXY << 30) | pdev->get_ReqCompletion(pdev));
087af1
 	out = urb_create_iocompletion(InterfaceId, MessageId, RequestId, OutputBufferSize);
087af1
 
087af1
@@ -724,6 +728,15 @@ static UINT urb_bulk_or_interrupt_transfer(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBA
087af1
 	Stream_Read_UINT32(s, TransferFlags); /** TransferFlags */
087af1
 	Stream_Read_UINT32(s, OutputBufferSize);
087af1
 	EndpointAddress = (PipeHandle & 0x000000ff);
087af1
+
087af1
+	if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
087af1
+	{
087af1
+		if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
087af1
+		{
087af1
+			return ERROR_INVALID_DATA;
087af1
+		}
087af1
+	}
087af1
+
087af1
 	/**  process TS_URB_BULK_OR_INTERRUPT_TRANSFER */
087af1
 	return pdev->bulk_or_interrupt_transfer(pdev, callback, MessageId, RequestId, EndpointAddress,
087af1
 	                                        TransferFlags, noAck, OutputBufferSize,
087af1
@@ -808,6 +821,13 @@ static UINT urb_isoch_transfer(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* callback
087af1
 	packetDescriptorData = Stream_Pointer(s);
087af1
 	Stream_Seek(s, NumberOfPackets * 12);
087af1
 	Stream_Read_UINT32(s, OutputBufferSize);
087af1
+
087af1
+	if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
087af1
+	{
087af1
+		if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
087af1
+			return ERROR_INVALID_DATA;
087af1
+	}
087af1
+
087af1
 	return pdev->isoch_transfer(
087af1
 	    pdev, callback, MessageId, RequestId, EndpointAddress, TransferFlags, StartFrame,
087af1
 	    ErrorCount, noAck, packetDescriptorData, NumberOfPackets, OutputBufferSize,
087af1
-- 
087af1
2.37.1
087af1