On Thu, 22 Nov 2018 at 10:01, Tobias Schramm <toblemi...@gmail.com> wrote: > > Before there might have been as little as one single byte left which would > result > int 3 bytes of blob_attr->id_len being out of bounds > > Signed-off-by: Tobias Schramm <toblemi...@gmail.com> > --- > blob.h | 4 ++-- > blobmsg.h | 2 +- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/blob.h b/blob.h > index a092f5d..2304f8c 100644 > --- a/blob.h > +++ b/blob.h > @@ -242,7 +242,7 @@ blob_put_u64(struct blob_buf *buf, int id, uint64_t val) > > #define __blob_for_each_attr(pos, attr, rem) \ > for (pos = (struct blob_attr *) attr; \ > - rem > 0 && (blob_pad_len(pos) <= rem) && \ > + rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && > \
I think blob_pad_len(pos) already covers sizeof(struct blob_attr) yousong > (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ > rem -= blob_pad_len(pos), pos = blob_next(pos)) > > @@ -250,7 +250,7 @@ blob_put_u64(struct blob_buf *buf, int id, uint64_t val) > #define blob_for_each_attr(pos, attr, rem) \ > for (rem = attr ? blob_len(attr) : 0, \ > pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \ > - rem > 0 && (blob_pad_len(pos) <= rem) && \ > + rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && > \ > (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ > rem -= blob_pad_len(pos), pos = blob_next(pos)) > > diff --git a/blobmsg.h b/blobmsg.h > index b06ef59..c75f1d9 100644 > --- a/blobmsg.h > +++ b/blobmsg.h > @@ -266,7 +266,7 @@ int blobmsg_printf(struct blob_buf *buf, const char > *name, const char *format, . > #define blobmsg_for_each_attr(pos, attr, rem) \ > for (rem = attr ? blobmsg_data_len(attr) : 0, \ > pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \ > - rem > 0 && (blob_pad_len(pos) <= rem) && \ > + rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && > \ > (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ > rem -= blob_pad_len(pos), pos = blob_next(pos)) > > -- > 2.19.1 > > > _______________________________________________ > openwrt-devel mailing list > openwrt-devel@lists.openwrt.org > https://lists.openwrt.org/mailman/listinfo/openwrt-devel _______________________________________________ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel