Skip to content

NSCMD_DEVICEQUERY with mn_Length 0 reads SANA-II fields past a 48-byte IOStdReq #64

Description

@tinic

Residual recorded when #41 (NSCMD_DEVICEQUERY on a plain IOStdReq) landed as b309892.

NETDEV_IO_IS_SHORT() (src/netdev/netdev_internal.h) treats mn_Length == 0 as a FULL IOSana2Req, by design and consistently for Open, Close, BeginIO and the query, because SANA-II callers that leave mn_Length unset depend on it. The consequence for netdev_nsd_query() (src/netdev/netdev_cmds.c): a hand-built 48-byte IOStdReq with mn_Length 0 sending NSCMD_DEVICEQUERY is answered in the SANA-II form, reading ios2_Data/ios2_DataLength at +76/+72, past the end of the 48-byte request, and may write the 16-byte answer through whatever is there.

CreateIORequest() sets mn_Length, so callers that allocate normally are safe. No known program sends the zero-length form; tracking it in case one appears. A possible narrowing: in the query only, treat mn_Length == 0 as the IOStdReq form (the NewStyle spec's form) since the SANA-II form is only what mcastfilter sends, and mcastfilter sets mn_Length.

🤖 Generated with Claude Code

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions