tjh.dev
1From 904e9dee373eca499e976dce131f0baee06db2d6 Mon Sep 17 00:00:00 2001
2From: Alyssa Ross <hi@alyssa.is>
3Date: Thu, 13 Feb 2025 12:05:17 +0100
4Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read
5
6*len is the length of the destination buffer, but program->blks is
7probably not anywhere near that long. It's already been checked above
8that BPF_PGM_SIZE(program) is less than or equal to *len, so that's
9the correct value to use here to avoid either reading or writing too
10much.
11
12I noticed this because tests/11-basic-basic_errors started failing on
13musl after e797591 ("all: add seccomp_precompute() functionality").
14
15Signed-off-by: Alyssa Ross <hi@alyssa.is>
16---
17Link: https://github.com/seccomp/libseccomp/pull/458
18
19 src/api.c | 2 +-
20 1 file changed, 1 insertion(+), 1 deletion(-)
21
22diff --git a/src/api.c b/src/api.c
23index adccef3..65a277a 100644
24--- a/src/api.c
25+++ b/src/api.c
26@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
27 if (BPF_PGM_SIZE(program) > *len)
28 rc = _rc_filter(-ERANGE);
29 else
30- memcpy(buf, program->blks, *len);
31+ memcpy(buf, program->blks, BPF_PGM_SIZE(program));
32 }
33 *len = BPF_PGM_SIZE(program);
34
35--
362.47.0
37