Buffer overflow in ax_port_read

timhawes · timhawes · commit ea8e476434be · 2020-05-02T11:15:38.000+01:00
diff --git a/src/tcp_axtls.c b/src/tcp_axtls.c
@@ -562,7 +562,7 @@ int ax_port_read(int fd, uint8_t *data, int len) {
     return 0;
   }
 
-  read_buf =(uint8_t*)calloc(fd_data->tcp_pbuf->len + 1, sizeof(uint8_t));
+  read_buf =(uint8_t*)calloc(len, sizeof(uint8_t));
   pread_buf = read_buf;
   if (pread_buf != NULL){
     recv_len = pbuf_copy_partial(fd_data->tcp_pbuf, read_buf, len, fd_data->pbuf_offset);

Original file line number	Diff line number	Diff line change
`@@ -562,7 +562,7 @@ int ax_port_read(int fd, uint8_t *data, int len) {`
`562`	`562`	`return 0;`
`563`	`563`	`}`
`564`	`564`
`565`		`- read_buf =(uint8_t*)calloc(fd_data->tcp_pbuf->len + 1, sizeof(uint8_t));`
	`565`	`+ read_buf =(uint8_t*)calloc(len, sizeof(uint8_t));`
`566`	`566`	`pread_buf = read_buf;`
`567`	`567`	`if (pread_buf != NULL){`
`568`	`568`	`recv_len = pbuf_copy_partial(fd_data->tcp_pbuf, read_buf, len, fd_data->pbuf_offset);`