summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* blobmsg: Don't do at run-time what can be done at compile-timeHEADmasterPhilip Prindeville2023-04-161-3/+3
| | | | | | | | | Repeatedly calling a run-time function like strlen() on an invariant value is inefficient, especially if that value can be computed once (at initialization) or better yet, computed at compile-time. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* jshn.sh: Add pretty-printing to json_dumpPhilip Prindeville2023-04-151-1/+11
| | | | | | | | | | | | If a JSON file might be read by a human, say for debugging, it could be useful to pretty-print it. We do this in places by calling "json_dump -i" but it shouldn't be necessary to know the arguments to "jshn" (and indeed, that's not portable if we retool the underlying implementation). Conversely output that's ephemeral doesn't need to be pretty (say being piped as input to another command). Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* usock: fix poll return code checkFelix Fietkau2023-03-081-4/+1
| | | | | | | errno needs to be compared against EINTR/EAGAIN instead of the return code, and only if the return code is < 0. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blobmsg: add blobmsg_parse_array_attrFelix Fietkau2023-01-031-1/+8
| | | | | | Wrapper around blobmsg_parse_array, similar to blobmsg_parse_attr Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blobmsg: add blobmsg_parse_attr functionFelix Fietkau2022-11-231-0/+7
| | | | | | | | | | This allows turning the common pattern of: blobmsg_parse(policy, ARRAY_SIZE(policy), tb, blobmsg_data(data), blobmsg_len(data)); into: blobmsg_parse_attr(policy, ARRAY_SIZE(policy), tb, data); Signed-off-by: Felix Fietkau <nbd@nbd.name>
* jshn.sh: add json_add_fields function for adding multiple fields at onceFelix Fietkau2022-09-271-0/+23
| | | | | | This simplifies passing extra object data as a function parameter Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blobmsg: work around false positive gcc -Warray-bounds warningsFelix Fietkau2022-05-151-1/+1
| | | | | | | | | | | Using the return value of blobmsg_name as input argument to strcpy can lead to warnings like these: error: 'strcpy' offset 6 from the object at 'cur' is out of the bounds of referenced subobject 'name' with type 'uint8_t[]' {aka 'unsigned char[]'} at offset 6 [-Werror=array-bounds] Fix this by replacing hdr->name with the equivalent hdr + 1 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blobmsg: implicitly reserve space for 0-terminator in string buf allocFelix Fietkau2022-05-122-4/+5
| | | | | | | | | It may not be clear to all users of this API if the provided maxlen argument refers to the maximum string length or the maximum buffer size. In order to improve safety and convenience of this API, make it refer to the maximum string length. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* list.h: add container_of_safe macroFelix Fietkau2022-04-291-0/+8
| | | | | | It works like container_of, except that it also deals with NULL pointers Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blob: clear buf->head when freeing a bufferFelix Fietkau2022-02-101-0/+1
| | | | | | Prevents accidental silent use-after-free bugs Signed-off-by: Felix Fietkau <nbd@nbd.name>
* vlist: define vlist_for_each_element_safeDaniel Golle2021-11-201-0/+3
| | | | | | | | Yet another macro wrapper around the corresponding avl_* macro. This new macro makes it possible to iterate over vlists in ways which may have destructive consequences without being punished by segfault. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uloop: deprecate uloop_timeout_remainingStijn Tintel2021-11-041-1/+1
| | | | | | | | We have uloop_timeout_remaining64 now. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io> Acked-by: John Crispin <john@phrozen.org>
* lua/uloop: use uloop_timeout_remaining64Stijn Tintel2021-11-041-1/+1
| | | | | | | | We will deprecate uloop_timeout_remaining soon. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io> Acked-by: John Crispin <john@phrozen.org>
* uloop: add uloop_timeout_remaining64Stijn Tintel2021-11-042-0/+13
| | | | | | | | | This uses the same return type as tv_diff so we don't need to check for integer overflow. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io> Acked-by: John Crispin <john@phrozen.org>
* uloop: restore return type of uloop_timeout_remainingStijn Tintel2021-11-042-3/+12
| | | | | | | | | | | The uloop_timeout_remaining function is public and changing its return type breaks ABI. Change the return type back to int, and return INT_MIN or INT_MAX if the value returned by tv_diff would overflow integer. Fixes: be3dc7223a6d ("uloop: avoid integer overflow in tv_diff") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io> Acked-by: John Crispin <john@phrozen.org>
* uloop: avoid integer overflow in tv_diffStijn Tintel2021-11-042-4/+4
| | | | | | | | | | | The tv_diff function can potentially overflow as soon as t2->tv_sec is larger than 2147483. This is very easily hit in ujail, after only 2147484 seconds of uptime, or 24.85 days. Improve the behaviour by changing the return type to int64_t. Fixes: FS#3943 Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* list.h: add a few missing iterator macrosFelix Fietkau2021-08-191-0/+12
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* json_script: fix unannotated fall-through warningFelix Fietkau2021-05-161-1/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* utils.h: add fallthrough macroFelix Fietkau2021-05-161-0/+12
| | | | | | This can be used to silence clang warnings about unannotated fall-through Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blob: fix exceeding maximum buffer lengthZefir Kurtisi2021-04-291-0/+2
| | | | | | | | | | | | | | Currently there is no measure in place to prevent the blob buffer to exceed its maximum allowed length of 16MB. Continuously calling blob_add() will expand the buffer until it exceeds BLOB_ATTR_LEN_MASK and after that will return valid blob_attr pointer without increasing the buflen. A test program was added in the previous commit, this one fixes the issue by asserting that the new bufflen after grow does not exceed BLOB_ATTR_LEN_MASK. Signed-off-by: Zefir Kurtisi <zefir.kurtisi@gmail.com>
* tests: add blob-buffer overflow testZefir Kurtisi2021-04-292-0/+40
| | | | | | | | | | | | | | | | | | | | The blob buffer has no limitation in place to prevent buflen to exceed maximum size. This commit adds a test to demonstrate how a blob increases past the maximum allowd size of 16MB. It continuously adds chunks of 64KB and with the 255th one blob_add() returns a valid attribute pointer but the blob's buflen does not increase. The test is used to demonstrate the failure, which is fixed with a follow-up commit. Signed-off-by: Zefir Kurtisi <zefir.kurtisi@gmail.com> [adjusted test case for cram usage] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libubox: tests: add more blobmsg/json test casesPeter Seiderer2021-03-092-0/+453
| | | | | | | * add mixed int/double tests * add blobmsg_cast_u64/blobmsg_cast_s64 tests Signed-off-by: Peter Seiderer <ps.report@gmx.net>
* tests: cram: test_base64: really fix failing testsPetr Štetiar2021-03-031-7/+3
| | | | | | | | Remove the checks for 'Aborted (core dumped)' message altogether as it's not reliable and not portable. References: https://gitlab.com/openwrt/project/libubox/-/jobs/1070226897 Signed-off-by: Petr Štetiar <ynezz@true.cz>
* tests: cram: test_base64: fix failing testsPetr Štetiar2021-03-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Seems like latest version of llvm compiler/sanitizer has changed behaviour during crash so `Aborted (core dumped)` is now printed to stdout. Fixes following issue: --- /builds/openwrt/project/libubox/tests/cram/test_base64.t +++ /builds/openwrt/project/libubox/tests/cram/test_base64.t.err @@ -49,9 +49,7 @@ b64_encode: Assertion `dest && targsize > 0' failed. $ test-b64_decode-san 2> output.log; check - Aborted (core dumped) b64_decode: Assertion `dest && targsize > 0' failed. $ test-b64_encode-san 2> output.log; check - Aborted (core dumped) b64_encode: Assertion `dest && targsize > 0' failed. References: https://gitlab.com/openwrt/project/libubox/-/jobs/1069840314 Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libubox: fix BLOBMSG_CAST_INT64 (do not override BLOBMSG_TYPE_DOUBLE)Peter Seiderer2021-03-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 9e52171 ('blobmsg: introduce BLOBMSG_CAST_INT64') broke blobmsg_parse() for BLOBMSG_TYPE_DOUBLE. This is because the enum definition leads to the following double define for BLOBMSG_CAST_INT64/BLOBMSG_TYPE_DOUBLE as value 8. Tested with: $ cat test-enum-001.c #include <stdio.h> enum blobmsg_type { BLOBMSG_TYPE_UNSPEC, BLOBMSG_TYPE_ARRAY, BLOBMSG_TYPE_TABLE, BLOBMSG_TYPE_STRING, BLOBMSG_TYPE_INT64, BLOBMSG_TYPE_INT32, BLOBMSG_TYPE_INT16, BLOBMSG_TYPE_INT8, BLOBMSG_TYPE_DOUBLE, __BLOBMSG_TYPE_LAST, BLOBMSG_TYPE_LAST = __BLOBMSG_TYPE_LAST - 1, BLOBMSG_TYPE_BOOL = BLOBMSG_TYPE_INT8, BLOBMSG_CAST_INT64, }; int main(int artc, char* argv[]) { printf("BLOBMSG_TYPE_UNSPEC: %d\n", BLOBMSG_TYPE_UNSPEC); printf("BLOBMSG_TYPE_ARRAY: %d\n", BLOBMSG_TYPE_ARRAY); printf("BLOBMSG_TYPE_TABLE: %d\n", BLOBMSG_TYPE_TABLE); printf("BLOBMSG_TYPE_STRING: %d\n", BLOBMSG_TYPE_STRING); printf("BLOBMSG_TYPE_INT64: %d\n", BLOBMSG_TYPE_INT64); printf("BLOBMSG_TYPE_INT32: %d\n", BLOBMSG_TYPE_INT32); printf("BLOBMSG_TYPE_INT16: %d\n", BLOBMSG_TYPE_INT16); printf("BLOBMSG_TYPE_INT8: %d\n", BLOBMSG_TYPE_INT8); printf("BLOBMSG_TYPE_DOUBLE: %d\n", BLOBMSG_TYPE_DOUBLE); printf("__BLOBMSG_TYPE_LAST: %d\n", __BLOBMSG_TYPE_LAST); printf("BLOBMSG_TYPE_LAST: %d\n", BLOBMSG_TYPE_LAST); printf("BLOBMSG_TYPE_BOOL: %d\n", BLOBMSG_TYPE_BOOL); printf("BLOBMSG_CAST_INT64: %d\n", BLOBMSG_CAST_INT64); return 0; } $ gcc test-enum-001.c $ ./a.out BLOBMSG_TYPE_UNSPEC: 0 BLOBMSG_TYPE_ARRAY: 1 BLOBMSG_TYPE_TABLE: 2 BLOBMSG_TYPE_STRING: 3 BLOBMSG_TYPE_INT64: 4 BLOBMSG_TYPE_INT32: 5 BLOBMSG_TYPE_INT16: 6 BLOBMSG_TYPE_INT8: 7 BLOBMSG_TYPE_DOUBLE: 8 __BLOBMSG_TYPE_LAST: 9 BLOBMSG_TYPE_LAST: 8 BLOBMSG_TYPE_BOOL: 7 BLOBMSG_CAST_INT64: 8 Fix this by changing the enum defintion to assign BLOBMSG_CAST_INT64 to the unique value 9. Signed-off-by: Peter Seiderer <ps.report@gmx.net>
* utils: simplify mkdir_p boolean conditionsRui Salvaterra2020-12-131-2/+2
| | | | | | Just a trivial simplification. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* utils: introduce mkdir_pDaniel Golle2020-12-122-0/+34
| | | | | | | Add new utility function mkdir_p(char *path, mode_t mode) to replace the partially buggy implementations found accross fstools and procd. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* blobmsg: introduce BLOBMSG_CAST_INT64Daniel Golle2020-08-062-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | | When dealing with 64-bit integers in JSON documents, blobmsg_parse becomes useless as blobmsg-json only uses BLOBMSG_TYPE_INT64 if the value exceeds the range of a 32-bit integer, otherwise BLOBMSG_TYPE_INT32 is used. This is because blobmsg-json parses the JSON document ad-hoc without knowing the schema in advance and hence a result of the design of blobmsg-json (and the absence of JSON schema definitions). In practise, this made code less readable as instead of using blobmsg_parse() one had to to deal with *all* attributes manually just to catch fields which can be both, BLOBMSG_TYPE_INT32 or BLOBMSG_TYPE_INT64, but are always dealt with as uint64_t in code as they potentially could exceed the 32-bit range. To resolve this issue, introduce as special wildcard attribute type BLOBMSG_CAST_INT64 which should only be used in policies used by blobmsg_parse(). If used for an attribute in the policy, blobmsg_parse shall accept all integer types and allow the user to retrieve the value using the uint64_t blobmsg_cast_u64() and int64_t blobmsg_cast_s64() functions which is also introduced by this commit. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* examples/lua: attempt to highlight some trapsKarl Palsson2020-07-111-3/+5
| | | | | | | | Ran into some issues with my fd event being garbage collected. As I never wanted to call :delete, I had seen no reason to keep the returned object, as my callback and upvalues were still valid. Signed-off-by: Karl Palsson <karlp@etactica.com>
* lua/uloop: fd_add: use absolute indices for argumentsKarl Palsson2020-07-111-6/+5
| | | | | | | | | Instead of having to adjust the index repeatedly as the stack is manipulated, use absolute addressing for the function arguments, so they stay the same throughout the call. Zero functional change, just subjectively easier to follow variables. Signed-off-by: Karl Palsson <karlp@etactica.com>
* lua/uloop: make get_sock_fd capable of absolute addressesKarl Palsson2020-07-111-1/+2
| | | | | | | The original code required the use of relative addresses into the lua stack. It should accept either. Signed-off-by: Karl Palsson <karlp@etactica.com>
* lua/uloop: fd_add() better args checkingKarl Palsson2020-07-111-11/+7
| | | | | | | | | | | Actually check for flags being valid, instead of simply ignoring the call if flags was zero. Use standard lua checks for the function argument, so you can get a normal "argument #2 was invalid, expected function, got xxx" instead of the vague, "invalid arg list" Signed-off-by: Karl Palsson <karlp@etactica.com>
* blobmsg: drop old comment about json formatting functionsRafał Miłecki2020-05-261-3/+0
| | | | | | | Those functions were moved out of blobmsg.h. Fixes: 0918243e90e6 ("move json formatting to the blobmsg_json library") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* blobmsg: fix missing length checksFelix Fietkau2020-05-261-46/+20
| | | | | | | | | | | | | blobmsg_check_attr_len was calling blobmsg_check_data for some, but not all attribute types. These checks was missing for arrays and tables. Additionally, the length check in blobmsg_check_data was a bit off, since it was comparing the blobmsg data length against the raw blob attr length. Fix this by checking the raw blob length against the buffer length in blobmsg_hdr_from_blob Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blobmsg: simplify and fix name length checks in blobmsg_check_nameFelix Fietkau2020-05-261-9/+4
| | | | | | | | blobmsg_hdr_valid_namelen was omitted when name==false The blob_len vs blobmsg_namelen changes were not taking into account potential padding between name and data Signed-off-by: Felix Fietkau <nbd@nbd.name>
* blobmsg: fix length in blobmsg_check_arrayFelix Fietkau2020-05-261-1/+1
| | | | | | | | | blobmsg_check_array_len expects the length of the full attribute buffer, not just the data length. Due to other missing length checks (fixed in the next commit), this did not show up as a test failure Signed-off-by: Felix Fietkau <nbd@nbd.name>
* tests: add fuzzer seed file for crash in blob_lenPetr Štetiar2020-05-263-0/+6
| | | | | | | | | | | | | | | | | Following regression was introduced in commit 5e75160f4878 ("blobmsg: fix attrs iteration in the blobmsg_check_array_len()"): Thread 1 "test-fuzz" received signal SIGSEGV, Segmentation fault. in blob_len (attr=0x6020000100d4) at libubox/blob.h:102 102 return (be32_to_cpu(attr->id_len) & BLOB_ATTR_LEN_MASK) - sizeof(struct blob_attr); blob_len (attr=0x6020000100d4) at /libubox/blob.h:102 blob_raw_len (attr=0x6020000100d4) at /libubox/blob.h:111 blob_pad_len (attr=0x6020000100d4) at /libubox/blob.h:120 blobmsg_check_array_len (attr=0x6020000000d0, type=0, blob_len=10) at /libubox/blobmsg.c:145 fuzz_blobmsg_parse (data=0x6020000000d0 "\001\004", size=10) at /libubox/tests/fuzz/test-fuzz.c:57 Signed-off-by: Petr Štetiar <ynezz@true.cz>
* blob: make blob_parse_untrusted more permissiveMatthias Schiffer2020-05-243-1/+47
| | | | | | | | Some tools like ucert use concatenations of multiple blobs. Account for this case by allowing the underlying buffer length to be greater than the blob length. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* blobmsg: fix attrs iteration in the blobmsg_check_array_len()Rafał Miłecki2020-05-241-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | Starting with 75e300aeec25 ("blobmsg: fix wrong payload len passed from blobmsg_check_array") blobmsg_check_array_len() gets *blob* length passed as argument. It cannot be used with __blobmsg_for_each_attr() which expects *data* length. Use blobmsg_for_each_attr() which calculates *data* length on its own. The same bug was already reported in the past and there was fix attempt in the commit cd75136b1342 ("blobmsg: fix wrong payload len passed from blobmsg_check_array"). That change made blobmsg_check_attr_len() calls fail however. This is hopefully the correct & complete fix: 1. blobmsg_check_array_len() gets *blob* length 2. It calls blobmsg_check_attr_len() which requires *blob* length 3. It uses blobmsg_for_each_attr() which gets *data* length This fixes iterating over random memory treated as attrs. That was resulting in check failing randomly for totally correct blobs. It's critical e.g. for procd project with its instance_fill_array() failing and procd not starting services. Fixes: 75e300aeec25 ("blobmsg: fix wrong payload len passed from blobmsg_check_array") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* tests: runqueue: try to fix race on GitLab CIPetr Štetiar2020-05-211-1/+1
| | | | | | | | | | | | | | | | Seems like the CI runners are slower and produce different test output: - [0/1] finish 'sleep 1' (killer) [1/1] start 'sleep 1' (sleeper) + [1/1] finish 'sleep 1' (killer) + [1/1] finish 'sleep 1' (killer) [1/1] cancel 'sleep 1' (sleeper) [0/1] finish 'sleep 1' (sleeper) [1/1] start 'sleep 1' (sleeper) Lets try to fix it by lowering the killing timeout. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libubox: runqueue: fix use-after-free bugAlban Bedel2020-05-214-31/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes a use-after-free bug in runqueue_task_kill(): Invalid read of size 8 at runqueue_task_kill (runqueue.c:200) by uloop_process_timeouts (uloop.c:505) by uloop_run_timeout (uloop.c:542) by uloop_run (uloop.h:111) by main (tests/test-runqueue.c:126) Address 0x5a4b058 is 24 bytes inside a block of size 208 free'd at free by runqueue_task_complete (runqueue.c:234) by runqueue_task_kill (runqueue.c:199) by uloop_process_timeouts (uloop.c:505) by uloop_run_timeout (uloop.c:542) by uloop_run (uloop.h:111) by main (tests/test-runqueue.c:126) Block was alloc'd at at calloc by add_sleeper (tests/test-runqueue.c:101) by main (tests/test-runqueue.c:123) Since commit 11e8afea (runqueue should call the complete handler from more places) the call to the complete() callback has been moved to runqueue_task_complete(). However in runqueue_task_kill() runqueue_task_complete() is called before the kill() callback. This will result in a use after free if the complete() callback frees the task struct. Furthermore runqueue_start_next() is already called at the end of runqueue_task_complete(), so there is no need to call it again in runqueue_task_kill(). The issue was that the _complete() callback frees the memory used by the task struct, which is then read after the _complete() callback returns. Ref: FS#3016 Signed-off-by: Alban Bedel <albeu@free.fr> [initial test case, kill cb comment fix] Signed-off-by: Chris Nisbet <nischris@gmail.com> [testcase improvements and commit subject/description tweaks] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libubox: runqueue fix comment in headerChris Nisbet2020-05-211-2/+2
| | | | | | | | The comment relating to the runqueue task structure 'cancel' callback indicated that the callback 'calls' runqueue_task_complete, which isn't quite right. The callback _should_ call runqueue_task_complete. Signed-off-by: Chris Nisbet <nischris@gmail.com>
* tests: list: add test case for list_empty iteratorPetr Štetiar2020-05-212-18/+54
| | | | | | Increasing unit testing code coverage. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* tests: blobmsg: add test caseChris Nisbet2020-02-272-0/+177
| | | | | | | | | * add a test for blobmsg_check_array() to test an array with a string in it This test was added in conjunction with a change to blobmsg_check_array() to get it to pass the length obtained from blob_len() rather than blobmsg_len(). Signed-off-by: Chris Nisbet <nischris@gmail.com>
* blobmsg: fix wrong payload len passed from blobmsg_check_arrayChris Nisbet2020-02-271-1/+1
| | | | | | | | | | | | | | | Fix incorrect use of blobmsg_len() on passed blobmsg to blobmsg_check_array_len() introduced in commit 379cd33d1992 ("fix wrong payload len passed from blobmsg_check_array") by using correct blob_len(). By using blobmsg_len() a value too small was passed to blobmsg_check_array() which could lead to this function returning an error when there is none. Fixes: 379cd33d1992 ("fix wrong payload len passed from blobmsg_check_array") Signed-off-by: Chris Nisbet <nischris@gmail.com> [add fixes tag, rewrap commit message] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* blobmsg: blobmsg_parse and blobmsg_parse_array oob read fixesJuraj Vijtiuk2020-01-205-20/+56
| | | | | | | | | | | | | | | | | | | | Fix out of bounds read in blobmsg_parse and blobmsg_check_name. The out of bounds read happens because blob_attr and blobmsg_hdr have flexible array members, whose size is 0 in the corresponding sizeofs. For example the __blob_for_each_attr macro checks whether rem >= sizeof(struct blob_attr). However, what LibFuzzer discovered was, if the input data was only 4 bytes, the data would be casted to blob_attr, and later on blob_data(attr) would be called even though attr->data was empty. The same issue could appear with data larger than 4 bytes, where data wasn't empty, but contained only the start of the blobmsg_hdr struct, and blobmsg_hdr name was empty. The bugs were discovered by fuzzing blobmsg_parse and blobmsg_array_parse with LibFuzzer. CC: Luka Perkov <luka.perkov@sartura.hr> Reviewed-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr> [refactored some checks, added fuzz inputs, adjusted unit test results] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* tests: prefer dynamically allocated buffersPetr Štetiar2020-01-205-21/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | Help detecting Valgrind OOB reads and other issues. Conditional jump or move depends on uninitialised value(s) at 0x5452886: blobmsg_parse (blobmsg.c:203) by 0x400A8E: test_blobmsg (tests/test-blobmsg-parse.c:66) by 0x400A8E: main (tests/test-blobmsg-parse.c:82) Conditional jump or move depends on uninitialised value(s) at 0x545247F: blobmsg_check_name (blobmsg.c:39) by 0x545247F: blobmsg_check_attr_len (blobmsg.c:79) by 0x5452710: blobmsg_parse_array (blobmsg.c:159) by 0x400AB8: test_blobmsg (tests/test-blobmsg-parse.c:69) by 0x400AB8: main (tests/test-blobmsg-parse.c:82) Conditional jump or move depends on uninitialised value(s) at 0x54524A0: blobmsg_check_name (blobmsg.c:42) by 0x54524A0: blobmsg_check_attr_len (blobmsg.c:79) by 0x5452710: blobmsg_parse_array (blobmsg.c:159) by 0x400AB8: test_blobmsg (tests/test-blobmsg-parse.c:69) by 0x400AB8: main (tests/test-blobmsg-parse.c:82) Ref: http://lists.infradead.org/pipermail/openwrt-devel/2020-January/021204.html Signed-off-by: Petr Štetiar <ynezz@true.cz>
* blobmsg_json: prefer snprintf usagePetr Štetiar2020-01-203-30/+50
| | | | | | | | Better safe than sorry and while at it prefer use of PRId16 and PRId32 formatting constants as well. Reviewed-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* blobmsg: blobmsg_vprintf: prefer vsnprintfPetr Štetiar2020-01-201-1/+8
| | | | | | | | Better safe than sorry and while at it add handling of possible *printf() failures. Reviewed-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* jshn: prefer snprintf usagePetr Štetiar2020-01-201-7/+9
| | | | | | | Better safe than sorry. Reviewed-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Petr Štetiar <ynezz@true.cz>
View Lorry Controller Status