mika/nx-hbmenu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed buffer overflow vuln with netloader args introduced with the original netloader commit. Fixed unrelated bounds check in launchAddArg() which assumed there was nothing after argData_s.buf within argData_s, which was no longer the case once nxlink_host was added to argData_s.

Browse Source
This commit is contained in:
yellows8 2018-10-27 16:08:39 -04:00
parent 1435a2fb3b
commit d616ed02a7
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common/launch.c
View File

@ -2,7 +2,7 @@
size_t launchAddArg(argData_s* ad, const char* arg) {
size_t len = strlen(arg)+1;
if ((ad->dst+len) >= (char*)(ad+1)) return len; // Overflow
if ((ad->dst+len) >= (char*)(ad->buf + sizeof(ad->buf))) return len; // Overflow
ad->buf[0]++;
strcpy(ad->dst, arg);
ad->dst += len;

2
common/netloader.c
View File

@ -464,6 +464,8 @@ int loadnro(menuEntry_s *me, int sock, struct in_addr remote) {
}
if (response == 0 ) {
if (netloaded_cmdlen > sizeof(me->args.buf)-1) netloaded_cmdlen = sizeof(me->args.buf)-1;
len = recvall(sock,me->args.dst, netloaded_cmdlen,0);
if (len != netloaded_cmdlen) {