From ea81b023e82dfc4f4232a0e21bb12e1a49803065 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sat, 28 Feb 2026 21:28:47 +0100 Subject: [PATCH] package/rtl_433: add patch for CVE-2025-34450 Fixes the following vulnerability: - CVE-2025-34450: merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfraw.c. When processing crafted or excessively large raw RF input data, the application may write beyond the bounds of a stack buffer, resulting in memory corruption or a crash. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations. For mroe information, see: - https://www.cve.org/CVERecord?id=CVE-2025-34450 - https://github.com/merbanan/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 76135019544058a282ceed87e10e5d5e03ca5558) Signed-off-by: Thomas Perale --- ...-overflow-in-rfraw-test-data-parsing.patch | 31 +++++++++++++++++++ package/rtl_433/rtl_433.mk | 3 ++ 2 files changed, 34 insertions(+) create mode 100644 package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch diff --git a/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch b/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch new file mode 100644 index 0000000000..6446fea0ab --- /dev/null +++ b/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch @@ -0,0 +1,31 @@ +From 25e47f8932f0401392ef1d3c8cc9ed5595bc894a Mon Sep 17 00:00:00 2001 +From: "Christian W. Zuckschwerdt" +Date: Wed, 8 Oct 2025 10:11:15 +0200 +Subject: [PATCH] Fix overflow in rfraw test data parsing (closes #3375) + +CVE: CVE-2025-34450 +Upstream: https://github.com/merbanan/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a +Signed-off-by: Thomas Perale +--- + src/rfraw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/rfraw.c b/src/rfraw.c +index 9f4c9780c..71a1c365d 100644 +--- a/src/rfraw.c ++++ b/src/rfraw.c +@@ -159,9 +159,14 @@ static bool parse_rfraw(pulse_data_t *data, char const **p) + data->num_pulses++; + pulse_needed = true; + } ++ // abort reading if the pulse data array is full ++ if (data->num_pulses >= PD_MAX_PULSES) { ++ break; ++ } + } + //data->gap[data->num_pulses - 1] = 3000; // TODO: extend last gap? + ++ // expand reapeats as long as the pulse data array has enough space + unsigned pkt_pulses = data->num_pulses - prev_pulses; + for (int i = 1; i < repeats && data->num_pulses + pkt_pulses <= PD_MAX_PULSES; ++i) { + memcpy(&data->pulse[data->num_pulses], &data->pulse[prev_pulses], pkt_pulses * sizeof (*data->pulse)); diff --git a/package/rtl_433/rtl_433.mk b/package/rtl_433/rtl_433.mk index 08735be850..fc6c2bece2 100644 --- a/package/rtl_433/rtl_433.mk +++ b/package/rtl_433/rtl_433.mk @@ -10,6 +10,9 @@ RTL_433_LICENSE = GPL-2.0+ RTL_433_LICENSE_FILES = COPYING RTL_433_CPE_ID_VALID = YES +# 0002-Fix-overflow-in-rfraw-test-data-parsing.patch +RTL_433_IGNORE_CVES += CVE-2025-34450 + # Force Release build to remove ASAN. RTL_433_CONF_OPTS = \ -DCMAKE_BUILD_TYPE=Release \