[PATCH] nfc: llcp: validate TLV length to prevent out-of-bounds read

[Syed Abdul Khaliq <abdul@bugqore.com>]

nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() walk a TLV
array taken from an LLCP PDU received from a remote peer. The loop is
bounded only by "offset < tlv_array_len", so it reads the length byte
tlv[1] and, via llcp_tlv8()/llcp_tlv16(), the value bytes tlv[2] and
tlv[3] without checking that the full TLV (2 + length bytes) actually
fits inside the array.

A truncated or malformed TLV therefore triggers an out-of-bounds read of
the received skb data. For example a CONNECT PDU whose payload after the
2-byte LLCP header is a single MIUX type byte gives tlv_array_len == 1:
tlv[1] is read one byte past the buffer, and the MIUX handler goes on to
read tlv[2]/tlv[3] via llcp_tlv16(). A TLV whose length field runs past
the end of the array makes the following iteration dereference tlv well
beyond the buffer. nfc_llcp_parse_connection_tlv() parses the data
directly out of the received skb (net/nfc/llcp_core.c), so the read runs
off the end of the slab allocation.

Reject any TLV that does not fully fit in the remaining array before
reading its length and value.

Signed-off-by: Syed Abdul Khaliq <abdul@bugqore.com>
---
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 291f26facb..4e22788f95 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -201,6 +201,13 @@ int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
 		return -ENODEV;
 
 	while (offset < tlv_array_len) {
+		if (tlv_array_len - offset < 2 ||
+		    tlv[1] > tlv_array_len - offset - 2) {
+			pr_err("Malformed TLV, offset %d array length %d\n",
+			       offset, tlv_array_len);
+			return -EINVAL;
+		}
+
 		type = tlv[0];
 		length = tlv[1];
 
@@ -251,6 +258,13 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
 		return -ENOTCONN;
 
 	while (offset < tlv_array_len) {
+		if (tlv_array_len - offset < 2 ||
+		    tlv[1] > tlv_array_len - offset - 2) {
+			pr_err("Malformed TLV, offset %d array length %d\n",
+			       offset, tlv_array_len);
+			return -EINVAL;
+		}
+
 		type = tlv[0];
 		length = tlv[1];
 
-- 
2.50.1 (Apple Git-155)