blobmsg: fix unsigned integer overflow in blobmsg_alloc_string_buffer()

blobmsg_alloc_string_buffer() increments maxlen by 1 to account for
the null terminator. When maxlen is UINT_MAX, this increment wraps
to 0, causing blobmsg_new() to allocate a zero-length payload. A
subsequent write to the returned buffer would then overflow the
blob's allocated space, corrupting adjacent memory.

Add a bounds check before the increment to reject UINT_MAX input.

Link: https://github.com/openwrt/libubox/pull/42
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 58b6543f1b2521a5d55c5952f69b9ef5ade0f835)

1 files changed, 2 insertions, 0 deletions

diff --git a/blobmsg.c b/blobmsg.c
index af3bd23..4c36c57 100644
--- a/blobmsg.c
+++ b/blobmsg.c
@@ -340,6 +340,8 @@ blobmsg_alloc_string_buffer(struct blob_buf *buf, const char *name, unsigned int
 	struct blob_attr *attr;
 	void *data_dest;
 
+	if (maxlen == (unsigned int)-1)
+		return NULL;
 	maxlen++;
 	attr = blobmsg_new(buf, BLOBMSG_TYPE_STRING, name, maxlen, &data_dest);
 	if (!attr)