You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by "anchao (via GitHub)" <gi...@apache.org> on 2026/10/22 14:20:25 UTC
[PR] usbdev/cdcncm: validate host-provided NTB bounds [nuttx]
anchao opened a new pull request, #20883:
URL: https://github.com/apache/nuttx/pull/20883
## Summary
Harden CDC-NCM receive parsing against malformed host-provided NTBs.
## Changes
- Reject short NTBs before reading the NTH header.
- Reject NTB block lengths that exceed either the configured maximum or the
actual received byte count.
- Bound the number of NDPs parsed from a single NTB so a self-referencing NDP
chain cannot loop indefinitely.
- Validate that each NDP lies fully inside the NTB.
- Reject datagrams whose offset and length extend outside the received block.
## Testing
sim/usbdev
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] usbdev/cdcncm: validate host-provided NTB bounds [nuttx]
Posted by "acassis (via GitHub)" <gi...@apache.org>.
acassis merged PR #20883:
URL: https://github.com/apache/nuttx/pull/20883
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] usbdev/cdcncm: validate host-provided NTB bounds [nuttx]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #20883:
URL: https://github.com/apache/nuttx/pull/20883#issuecomment-6353728461
<!-- membrowse-pr-comment -->
## <img src="https://membrowse.com/membrowse-logo.svg" height="24" align="top"> MemBrowse Memory Report · [Explore what changed →](https://membrowse.com/public/apache/nuttx?commit_sha=8e8b328668942cba7294288cc4818ace2f90abd9)
*No memory changes detected for:*
- [arduino-mega2560](https://membrowse.com/public/apache/nuttx/target/arduino-mega2560/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [esp32-devkitc](https://membrowse.com/public/apache/nuttx/target/esp32-devkitc/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [hifive1-revb](https://membrowse.com/public/apache/nuttx/target/hifive1-revb/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [mirtoo](https://membrowse.com/public/apache/nuttx/target/mirtoo/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [qemu-armv8a](https://membrowse.com/public/apache/nuttx/target/qemu-armv8a/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [qemu-intel64](https://membrowse.com/public/apache/nuttx/target/qemu-intel64/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [rx65n-rsk2mb](https://membrowse.com/public/apache/nuttx/target/rx65n-rsk2mb/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [s698pm-dkit](https://membrowse.com/public/apache/nuttx/target/s698pm-dkit/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
- [stm32-nucleo-f103rb](https://membrowse.com/public/apache/nuttx/target/stm32-nucleo-f103rb/compare?head=8e8b328668942cba7294288cc4818ace2f90abd9&base=879ad9c59e3239a51520de8f53c1d492d26148ee)
---
<sub>Catch memory regressions in CI with [MemBrowse](https://membrowse.com). Free for open source.</sub>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org