Hi,
After the "blobmsg: blobmsg_parse and blobmsg_parse_array oob read fixes"
update in libubox, umdns will fail to start with error printed in log:
procd: /etc/rc.d/S80umdns: Command failed: Invalid argument
The startup script sends this command to ubus and the command fails:
# ubus call umdns set_config '{ "interfaces": [ "br-lan" ] }'
Command failed: Invalid argument
In umdns, the command fails in function umdns_set_config() after doing:
if (!blobmsg_check_attr_list(data[CFG_INTERFACES], BLOBMSG_TYPE_STRING))
return UBUS_STATUS_INVALID_ARGUMENT;
I've done some debugging and command will fail if the name of the interface
is shorter than 8 characters, which br-lan is.
After doing some digging around the sources of libubox, the check fail in
blobmsg_check_name() on the line:
if ((char *) hdr->name + blobmsg_namelen(hdr) + 1 > limit)
return false;
I've added the printf statement just above:
printf("hdr->name: %s, namelen: %d, attr: %s (%d)\n", hdr->name,
blobmsg_namelen(hdr), (char *)attr, len);
printf("hdr->name: %p, attr: %p (%d), limit: %p\n", hdr->name, attr, len,
limit);
and the result (of the failed attempt) is:
hdr->name: interfaces, namelen: 10, attr: - (16)
hdr->name: 0x95404e, attr: 0x954048 (16), limit: 0x954058
It would seem as if the code is trying to compare the length of the
attribute (br-lan I would assume) with the length of the name of the data
section.
If the attribute is too short, the 'interfaces' string is longer and the
check fails...
I'm sorry I don't know that much about the ubus code to see where exactly
this logic fails.
Regards, Saso
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
