Skip to content

Commit 9bd781b

Browse files
authored
Sanitize bclass read from binary data in smd, io and pebble plugins ##security
* bclass is used for io redirections in the uf2 plugin, but this can be exploited from other io plugins
1 parent 81c3486 commit 9bd781b

3 files changed

Lines changed: 3 additions & 0 deletions

File tree

libr/bin/p/bin_io.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ static RBinInfo *info(RBinFile *bf) {
4444
ut8 tmp[32];
4545
r_buf_read_at (bf->buf, 0x100, tmp, sizeof (tmp));
4646
ret->bclass = r_str_ndup ((char *)tmp, 32);
47+
r_str_sanitize (ret->bclass);
4748
ret->os = strdup ("io");
4849
ret->arch = strdup ("arm");
4950
ret->bits = 64;

libr/bin/p/bin_pebble.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ static RBinInfo* info(RBinFile *bf) {
6262
ret->file = strdup (bf->file);
6363
ret->type = strdup ("pebble");
6464
ret->bclass = r_str_ndup (pai.name, 32);
65+
r_str_sanitize (ret->bclass);
6566
ret->rclass = r_str_ndup (pai.company, 32);
6667
ret->os = strdup ("rtos");
6768
ret->subsystem = strdup ("pebble");

libr/bin/p/bin_smd.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ static RBinInfo *info(RBinFile *bf) {
116116
ut8 tmp[32];
117117
r_buf_read_at (bf->buf, 0x100, tmp, sizeof (tmp));
118118
ret->bclass = r_str_ndup ((char *)tmp, 32);
119+
r_str_sanitize (ret->bclass);
119120
ret->os = strdup ("smd");
120121
ret->arch = strdup ("m68k");
121122
ret->bits = 32;

0 commit comments

Comments
 (0)