This series collects four independent robustness fixes to network, boot
image and filesystem code that handle attacker-influenced or on-disk
input. Each was found by auditing length handling around memcpy(),
integer arithmetic on packet/image data, and loop-counter widths.
1. net: nfs: the NFS client copies received UDP payloads into a
stack-allocated struct rpc_t with memcpy() using the wire length
without checking it against the destination size, allowing a
malicious NFS server to overflow the stack buffer. Add a bounds
check at each copy site.
2. boot: image-fit: the decompression path computes the output buffer
size as 'len * 20', which can wrap on 32/64-bit ulong for a large
image and cause a heap buffer overflow. Reject sizes that would
overflow before the multiplication.
3. net: tftp: the OACK option parser uses strcasecmp() on packet data
that may not be NUL-terminated within the received length, causing
an out-of-bounds read. Use a bounded strncasecmp() plus an explicit
terminator check.
4. fs: ext4: ext4fs_update() walks all block groups with a signed
16-bit loop counter while fs->no_blkgrp is a uint32_t. A filesystem
with more than 32767 block groups overflows the counter (undefined
behaviour) and the bitmap write-back loops fail to terminate
correctly. Widen the counter to u32.
The fixes are independent and can be applied in any order. Built for
sandbox (net/tftp.o, boot/image-fit.o, fs/ext4/ext4_write.o, and
net/nfs-common.o with CONFIG_CMD_NFS=y) and checked with
scripts/checkpatch.pl.
Daniel Munic (1):
fs: ext4: widen ext4fs_update() block-group loop counter
Drew Kluemke (3):
net: nfs: add bounds checks on memcpy into stack-allocated rpc_pkt
boot: image-fit: add overflow guard for FIT decompression buffer
net: tftp: use bounded string compare for OACK option parsing
boot/image-fit.c | 10 +++++++++-
fs/ext4/ext4_write.c | 2 +-
net/nfs-common.c | 10 ++++++++++
net/tftp.c | 13 +++++++++----
4 files changed, 29 insertions(+), 6 deletions(-)
--
2.49.0
