Swatantra-66 opened a new pull request, #21304:
URL: https://github.com/apache/nuttx/pull/21304
## Summary
Fixes #21111
In `ftmac100_receive()`, the device-reported frame length was read directly
from the DMA descriptor status word (`FTMAC100_RXDES0_RFL(rxdes->rxdes0)`,
0..2047) and copied into `priv->ft_dev.d_buf` without checking if it exceeds
`CONFIG_NET_ETH_PKTSIZE` or satisfies the minimum Ethernet frame header length
`ETH_HDRLEN`.
Because `g_pktbuf` is sized to `PKTBUF_SIZE` (`MAX_NETDEV_PKTSIZE +
CONFIG_NET_GUARDSIZE`, ~592 or ~1518 bytes depending on configuration), an
incoming oversized frame (or malfunctioning/compromised MAC) could trigger an
out-of-bounds write past the packet buffer into adjacent BSS variables.
This change adds an input bounds check:
1. Drops frames where `len < ETH_HDRLEN` or `len > CONFIG_NET_ETH_PKTSIZE`.
2. Increments `NETDEV_RXERRORS(&priv->ft_dev)`.
3. Safely recycles the RX descriptor back to DMA ownership
(`FTMAC100_RXDES0_RXDMA_OWN`) and advances `rx_pointer`, preventing descriptor
ring stalling or memory leaks without performing the `memcpy`.
Matches the pattern in sibling network drivers (`dm90x0.c`, `enc28j60.c`,
`encx24j600.c`, `lan91c111.c`, `w5500.c`).
## Impact
- **Is new feature added?** No.
- **Is existing feature changed?** Yes, drops oversized or truncated/runt RX
frames in FTMAC100.
- **User impact:** None for normal traffic; protects systems from heap/BSS
memory corruption caused by malformed or oversized wire frames.
- **Build impact:** None.
- **Hardware impact:** FTMAC100 10/100 Ethernet Controller
(`CONFIG_NET_FTMAC100`).
- **Security impact:** Resolves CWE-120 / CWE-787 (Buffer Copy without
Checking Size of Input / Out-of-bounds Write).
- **Compatibility:** Fully backward compatible.
## Testing
- Code style verified with `tools/nxstyle drivers/net/ftmac100.c`:
```
0 errors, 0 warnings
```
- Commit message format and guidelines verified with `tools/checkpatch.sh -m
-g`:
```
✔️ All checks pass
```
- Git diff whitespace check verified with `git diff --check`:
```
0 errors
```
- Make / CMake build-system parity verified: no build files modified
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
