blobmsg: fix heap buffer overflow in blobmsg_parse

[project/libubox.git] / blobmsg.c

diff --git a/blobmsg.c b/blobmsg.c
index 1a8b783e9ba92b35aff2b1a3ad6912a903b704e1..71d4a36a647cb7ac7bac01c6f79833fd3614d4a8 100644 (file)
--- a/blobmsg.c
+++ b/blobmsg.c
@@ -53,6 +53,9 @@ bool blobmsg_check_attr(const struct blob_attr *attr, bool name)
 
        id = blob_id(attr);
        len = blobmsg_data_len(attr);
+       if (len > blob_raw_len(attr))
+               return false;
+
        data = blobmsg_data(attr);
 
        if (id > BLOBMSG_TYPE_LAST)