Skip to content

Commit 1f2e3d1

Browse files
committed
Fix an OOBR in lwapp_control_print().
Ironically, the code I added to validate LWAPP packets better can do an out-of-bounds read if a message element type is out of range. This bug has been noted internally for some time, now Tommy DeVoss of Braze Security has discovered it independently. Get the array size right to fix this.
1 parent 70140f5 commit 1f2e3d1

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

print-lwapp.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -325,7 +325,13 @@ static const struct tok lwapp_msg_elem_values[] = {
325325
{ 0, NULL}
326326
};
327327

328-
static const uint16_t msg_elem_minlen[] = {
328+
/*
329+
* Message element type is an 8-bit value, so size the array to make any
330+
* uint8_t index valid. Array elements that are implicitly initialized to 0
331+
* effectively mean no minimum length requirement for the respective message
332+
* element types.
333+
*/
334+
static const uint16_t msg_elem_minlen[UINT8_MAX + 1] = {
329335
[LWAPP_MSGELEM_AC_ADDRESS] = 7,
330336
// Omit "Result Code".
331337
[LWAPP_MSGELEM_WTP_DESCRIPTOR] = 16,

0 commit comments

Comments
 (0)