Skip to content

fix: add missing validations and prevent buffer overflow in seccomp loader#15

Open
KenzieEdernez wants to merge 2 commits intocanonical:mainfrom
KenzieEdernez:improve
Open

fix: add missing validations and prevent buffer overflow in seccomp loader#15
KenzieEdernez wants to merge 2 commits intocanonical:mainfrom
KenzieEdernez:improve

Conversation

@KenzieEdernez
Copy link
Copy Markdown

Changes:

  1. Fixed Heap Buffer Overflow: The loader now allocates exactly the memory needed (len_bytes) instead of a fixed 32KB buffer, and verifies that the read size matches the allocation.
  2. Added File Validation: Implemented checks for "Magic Bytes" ('S', 'C') and Version number to reject invalid files.
  3. Added Size & Alignment Checks:
    • Verified that len_filter does not exceed MAX_BPF_SIZE.
    • Verified that len_filter is a valid multiple of sizeof(struct sock_filter) to ensure instruction alignment.
  4. Resource Cleanup* Updated main.c to properly close the file handle and free allocated memory before exiting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant