Skip to content

fix: validate recvfrom() return before indexing into buf (AUD-001) - #180

Open
occamsshavingkit wants to merge 1 commit into
Wiznet:masterfrom
occamsshavingkit:fix/aud-001-udp-loopback-oob
Open

fix: validate recvfrom() return before indexing into buf (AUD-001)#180
occamsshavingkit wants to merge 1 commit into
Wiznet:masterfrom
occamsshavingkit:fix/aud-001-udp-loopback-oob

Conversation

@occamsshavingkit

Copy link
Copy Markdown

Summary

Fixes out-of-bounds write in loopback_udpc() where buf[ret] = 0x00 was executed before checking whether ret <= 0.

Problem

In Application/loopback/loopback.c:247-254, the UDP client loopback executed:

ret = recvfrom(sn, buf, size, destip, (uint16_t*)&destport);
buf[ret] = 0x00;                    // OOB if ret < 0 or ret == DATA_BUF_SIZE
printf("recv form[...]: %s\n", ...);
if (ret <= 0) { return ret; }       // check comes too late
  • ret == DATA_BUF_SIZE writes one byte past the buffer (stack-buffer-overflow under ASan)
  • Negative returns (e.g. SOCKERR_SOCKCLOSED = -13) index before the buffer (stack-buffer-underflow)

Fix

Move the ret <= 0 check before buf[ret] = 0x00 and printf(), preserving both after the guard.

Verification

  • Multi-chip compile check: passes for all 7 _WIZCHIP_ values
  • ASan/UBSan: host harness with mocked recvfrom() returning DATA_BUF_SIZE, -13, and 0 — no sanitizer abort

Move the null-termination write (buf[ret] = 0x00) and the corresponding
printf() after the ret <= 0 guard, so a negative return from recvfrom()
or a full-capacity datagram cannot write out of bounds.

Before this fix, ret == DATA_BUF_SIZE wrote one byte past the buffer, and
a negative return indexed before it.
niansa added a commit to niansa/ioLibrary_Driver that referenced this pull request Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant