From 3cb56e934f9e52597cb70caea3aa6c84f192d445 Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Mon, 29 Dec 2014 20:37:45 +0100 Subject: libpayload: avoid memory overflows With commands typically shorter than the buffer they're copied to, copy cmdlen bytes, cut off by the buffer limit. Change-Id: Ia9d2663bd145eff4538084ac1ef8850cfbcea924 Signed-off-by: Patrick Georgi Found-by: Coverity Scan Reviewed-on: http://review.coreboot.org/7977 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel Reviewed-by: Edward O'Callaghan --- payloads/libpayload/drivers/usb/usbmsc.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'payloads') diff --git a/payloads/libpayload/drivers/usb/usbmsc.c b/payloads/libpayload/drivers/usb/usbmsc.c index 62428b6ebe..ccd693a84d 100644 --- a/payloads/libpayload/drivers/usb/usbmsc.c +++ b/payloads/libpayload/drivers/usb/usbmsc.c @@ -200,6 +200,11 @@ wrap_cbw (cbw_t *cbw, int datalen, cbw_direction dir, const u8 *cmd, { memset (cbw, 0, sizeof (cbw_t)); + /* commands are typically shorter, but we don't want overflows */ + if (cmdlen > sizeof(cbw->CBWCB)) { + cmdlen = sizeof(cbw->CBWCB); + } + cbw->dCBWSignature = cbw_signature; cbw->dCBWTag = ++tag; cbw->bCBWLUN = lun; -- cgit v1.2.3