DF-5300
usbd_get_iface() computes udev->ifaces + iface_index before bounds-checking iface_index — out-of-bounds/NULL-base pointer arithmetic on every call with an unvalidated index
Summary
Pointer addition precedes the bounds check: NULL ifaces + index up to 255 (unconfigured device) or small-array + 31*sizeof walks. Never dereferenced while OOB (no runtime impact; benign across the 139k-ioctl guest soak) but C UB one refactor from a real OOB. Move-addition-after-check fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5300 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 931 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
per-fix-DF-5300
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace; benign across 139k-ioctl guest soak in findings/poc/DF-5299/
Verified recommended fix
move the pointer addition after the bounds check
Verdict
untested (Info; pointer-arithmetic UB only, no runtime defect)
No comments yet.