https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec From dd759e8c4f5685b526638fba9ec4fc24c37c9aec Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Thu, 13 Feb 2025 12:05:17 +0100 Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read *len is the length of the destination buffer, but program->blks is probably not anywhere near that long. It's already been checked above that BPF_PGM_SIZE(program) is less than or equal to *len, so that's the correct value to use here to avoid either reading or writing too much. I noticed this because tests/11-basic-basic_errors started failing on musl after e797591 ("all: add seccomp_precompute() functionality"). Signed-off-by: Alyssa Ross Acked-by: Tom Hromatka Signed-off-by: Paul Moore (imported from commit e8dbc6b555fb936bdfb8ab86f9a45fda96a8b7a2) --- src/api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/api.c b/src/api.c index adccef32..65a277a4 100644 --- a/src/api.c +++ b/src/api.c @@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf, if (BPF_PGM_SIZE(program) > *len) rc = _rc_filter(-ERANGE); else - memcpy(buf, program->blks, *len); + memcpy(buf, program->blks, BPF_PGM_SIZE(program)); } *len = BPF_PGM_SIZE(program);