[OpenWrt-Devel] umdns Command failed: Invalid argument after libubox commit 43a103ff17ee

[Saso Slavicic]

Hi,


After the "blobmsg: blobmsg_parse and blobmsg_parse_array oob read fixes"
update in libubox, umdns will fail to start with error printed in log:

procd: /etc/rc.d/S80umdns: Command failed: Invalid argument

The startup script sends this command to ubus and the command fails:

# ubus call umdns set_config '{ "interfaces": [ "br-lan" ] }'
Command failed: Invalid argument

In umdns, the command fails in function umdns_set_config() after doing:

if (!blobmsg_check_attr_list(data[CFG_INTERFACES], BLOBMSG_TYPE_STRING))
	return UBUS_STATUS_INVALID_ARGUMENT;


I've done some debugging and command will fail if the name of the interface
is shorter than 8 characters, which br-lan is.

After doing some digging around the sources of libubox, the check fail in
blobmsg_check_name() on the line:

if ((char *) hdr->name + blobmsg_namelen(hdr) + 1 > limit)
	return false;

I've added the printf statement just above:

printf("hdr->name: %s, namelen: %d, attr: %s (%d)\n", hdr->name,
blobmsg_namelen(hdr), (char *)attr, len);
printf("hdr->name: %p, attr: %p (%d), limit: %p\n", hdr->name, attr, len,
limit);

and the result (of the failed attempt) is:

hdr->name: interfaces, namelen: 10, attr: - (16)
hdr->name: 0x95404e, attr: 0x954048 (16), limit: 0x954058

It would seem as if the code is trying to compare the length of the
attribute (br-lan I would assume) with the length of the name of the data
section.
If the attribute is too short, the 'interfaces' string is longer and the
check fails...

I'm sorry I don't know that much about the ubus code to see where exactly
this logic fails.


Regards, Saso


_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel