anchao opened a new pull request, #21101:
URL: https://github.com/apache/nuttx/pull/21101
## Summary
Improve malformed input handling across ICMPv6, USB host descriptor parsing,
USB storage geometry, partition parsing, and CDC-MBIM endpoint validation.
This series adds runtime validation for several cases where the code
previously
trusted packet, descriptor, or device-reported lengths too early. The
changes
make the affected paths reject inconsistent inputs before using them to walk
buffers, copy descriptors, index arrays, or perform size-based calculations.
Main changes:
- Bound ICMPv6 Router Advertisement option parsing by the actual ICMPv6
message length instead of the full IPv6 payload length.
- Validate USB configuration descriptor lengths while walking descriptors.
- Validate USB composite interface descriptor copies against both source and
destination buffer sizes.
- Bound USB composite member array writes by validating interface/IAD
records
and the calculated member count.
- Reject USB mass-storage devices that report a zero logical block size.
- Reject partition geometries with zero block or sector sizes before using
them
as divisors.
- Reject CDC-MBIM Bulk OUT endpoints that report a zero max packet size.
## Impact
No behavior change is expected for well-formed packets, descriptors, or
devices.
Malformed or inconsistent inputs are now rejected earlier instead of being
processed with invalid lengths or zero sizes.
Expected impact:
- avoids walking past received ICMPv6 Router Advertisement option data
- avoids non-advancing or out-of-range USB descriptor walks
- avoids copying USB composite descriptors beyond the generated
configuration
buffer
- avoids writing past the calculated USB composite member array
- avoids partition parsing with zero block or sector size geometry
- avoids CDC-MBIM transmit calculations with a zero Bulk OUT max packet size
- no API, ABI, build-system, or documentation impact is expected
## Patch list
```text
59780dcf25 net/icmpv6: Bound RA options by ICMPv6 length
684007e644 drivers/usbhost: Validate config descriptor walk
f71b73480e drivers/usbhost: Validate composite interface copies
2be88204c9 drivers/usbhost: Bound composite member writes
25400529ac drivers/usbhost: Reject zero storage block size
05c6c0c2f7 drivers/usbhost: Reject zero MBIM bulk packet size
## Testing
sim/usbdev
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
