From 0368e0abd00529bd6af0f22c2b52abc3f53a5779 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Thu, 17 Mar 2022 22:42:03 +0100 Subject: [PATCH] package/rtl_433: fix CVE-2022-25051 An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file. Signed-off-by: Fabrice Fontaine Signed-off-by: Yann E. MORIN --- ...low-in-Clipsal-CMR113-and-Somfy-IOHC.patch | 58 +++++++++++++++++++ package/rtl_433/rtl_433.mk | 3 + 2 files changed, 61 insertions(+) create mode 100644 package/rtl_433/0003-minor-Fix-overflow-in-Clipsal-CMR113-and-Somfy-IOHC.patch diff --git a/package/rtl_433/0003-minor-Fix-overflow-in-Clipsal-CMR113-and-Somfy-IOHC.patch b/package/rtl_433/0003-minor-Fix-overflow-in-Clipsal-CMR113-and-Somfy-IOHC.patch new file mode 100644 index 0000000000..e2088b29e7 --- /dev/null +++ b/package/rtl_433/0003-minor-Fix-overflow-in-Clipsal-CMR113-and-Somfy-IOHC.patch @@ -0,0 +1,58 @@ +From 2dad7b9fc67a1d0bfbe520fbd821678b8f8cc7a8 Mon Sep 17 00:00:00 2001 +From: "Christian W. Zuckschwerdt" +Date: Mon, 24 Jan 2022 15:53:20 +0100 +Subject: [PATCH] minor: Fix overflow in Clipsal-CMR113 and Somfy-IOHC reported + by aug5t7 + +[Retrieved from: +https://github.com/merbanan/rtl_433/commit/2dad7b9fc67a1d0bfbe520fbd821678b8f8cc7a8] +Signed-off-by: Fabrice Fontaine +--- + src/devices/cmr113.c | 4 ++-- + src/devices/somfy_iohc.c | 9 +++++---- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/src/devices/cmr113.c b/src/devices/cmr113.c +index c85dfac56..19ec5d421 100644 +--- a/src/devices/cmr113.c ++++ b/src/devices/cmr113.c +@@ -42,8 +42,8 @@ Kudos to Jon Oxer for decoding this stream and putting it here: + + */ + +-#define COMPARE_BITS 83 +-#define COMPARE_BYTES (COMPARE_BITS/8) ++#define COMPARE_BITS 83 ++#define COMPARE_BYTES ((COMPARE_BITS + 7) / 8) + + static int cmr113_decode(r_device *decoder, bitbuffer_t *bitbuffer) + { +diff --git a/src/devices/somfy_iohc.c b/src/devices/somfy_iohc.c +index 906cae53e..2c88067b5 100644 +--- a/src/devices/somfy_iohc.c ++++ b/src/devices/somfy_iohc.c +@@ -100,11 +100,12 @@ static int somfy_iohc_decode(r_device *decoder, bitbuffer_t *bitbuffer) + if (bitbuffer->num_rows != 1) + return DECODE_ABORT_EARLY; + +- int offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24; +- if (offset >= bitbuffer->bits_per_row[0] - 19 * 10) ++ unsigned offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24; ++ if (offset + 19 * 10 >= bitbuffer->bits_per_row[0]) + return DECODE_ABORT_EARLY; + +- int num_bits = bitbuffer->bits_per_row[0] - offset; ++ unsigned num_bits = bitbuffer->bits_per_row[0] - offset; ++ num_bits = MIN(num_bits, sizeof (b) * 8); + + int len = extract_bytes_uart(bitbuffer->bb[0], offset, num_bits, b); + if (len < 19) +@@ -120,7 +121,7 @@ static int somfy_iohc_decode(r_device *decoder, bitbuffer_t *bitbuffer) + // calculate and verify checksum + if (crc16lsb(b, len, 0x8408, 0x0000) != 0) // unreflected poly 0x1021 + return DECODE_FAIL_MIC; +- bitrow_printf(b, len * 8, "%s: offset %d, num_bits %d, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len); ++ bitrow_printf(b, len * 8, "%s: offset %u, num_bits %u, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len); + + int msg_type = (b[0]); + int dst_id = ((unsigned)b[4] << 24) | (b[3] << 16) | (b[2] << 8) | (b[1]); // assume Little-Endian diff --git a/package/rtl_433/rtl_433.mk b/package/rtl_433/rtl_433.mk index a5139ddae6..d1c28adbf5 100644 --- a/package/rtl_433/rtl_433.mk +++ b/package/rtl_433/rtl_433.mk @@ -17,6 +17,9 @@ RTL_433_CONF_OPTS = \ -DBUILD_TESTING_ANALYZER=OFF \ -DENABLE_SOAPYSDR=OFF +# 0003-minor-Fix-overflow-in-Clipsal-CMR113-and-Somfy-IOHC.patch +RTL_433_IGNORE_CVES += CVE-2022-25051 + ifeq ($(BR2_PACKAGE_LIBRTLSDR),y) RTL_433_DEPENDENCIES += librtlsdr RTL_433_CONF_OPTS += -DENABLE_RTLSDR=ON