4 Sep
2026
4 Sep
'26
8:57 a.m.
On Fri, Sep 04, 2026 at 10:36:59AM +0200, Johan Hovold wrote:
On Wed, Sep 02, 2026 at 10:59:16AM -0400, Adriano Cordova wrote:
The incoming message size from the device header (header.size) is trusted without checking that it is at least the size of the message header itself, but a value smaller than sizeof(struct gb_operation_msg_hdr) underflows request_size in gb_operation_create_incoming(), wraps around in gb_operation_message_alloc(), and results in a tiny buffer that is then written past its end in gb_operation_message_init().
Is it really? I was under the impression the only issue here was the potential zero-size-pointer deref.
You're right of course, there's a potential small (7 byte) OOB write here too.
Johan