Re: [Buildroot] [PATCH] package/rtl_433: add patch for CVE-2025-34450

[Thomas Perale via buildroot <buildroot@buildroot.org>]

In reply of:
> Fixes the following vulnerability:
> 
> - CVE-2025-34450:
>     merbanan/rtl_433 versions up to and including 25.02 and prior to
>     commit 25e47f8 contain a stack-based buffer overflow vulnerability in
>     the function parse_rfraw() located in src/rfraw.c. When processing
>     crafted or excessively large raw RF input data, the application may
>     write beyond the bounds of a stack buffer, resulting in memory
>     corruption or a crash. This vulnerability can be exploited to cause a
>     denial of service and, under certain conditions, may be leveraged for
>     further exploitation depending on the execution environment and
>     available mitigations.
> 
> For mroe information, see:
>   - https://www.cve.org/CVERecord?id=CVE-2025-34450
>   - https://github.com/merbanan/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to 2025.02.x & 2025.11.x. Thanks

> ---
>  ...-overflow-in-rfraw-test-data-parsing.patch | 31 +++++++++++++++++++
>  package/rtl_433/rtl_433.mk                    |  3 ++
>  2 files changed, 34 insertions(+)
>  create mode 100644 package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch
> 
> diff --git a/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch b/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch
> new file mode 100644
> index 0000000000..6446fea0ab
> --- /dev/null
> +++ b/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch
> @@ -0,0 +1,31 @@
> +From 25e47f8932f0401392ef1d3c8cc9ed5595bc894a Mon Sep 17 00:00:00 2001
> +From: "Christian W. Zuckschwerdt" <christian@zuckschwerdt.org>
> +Date: Wed, 8 Oct 2025 10:11:15 +0200
> +Subject: [PATCH] Fix overflow in rfraw test data parsing (closes #3375)
> +
> +CVE: CVE-2025-34450
> +Upstream: https://github.com/merbanan/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a
> +Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> +---
> + src/rfraw.c | 5 +++++
> + 1 file changed, 5 insertions(+)
> +
> +diff --git a/src/rfraw.c b/src/rfraw.c
> +index 9f4c9780c..71a1c365d 100644
> +--- a/src/rfraw.c
> ++++ b/src/rfraw.c
> +@@ -159,9 +159,14 @@ static bool parse_rfraw(pulse_data_t *data, char const **p)
> +             data->num_pulses++;
> +             pulse_needed = true;
> +         }
> ++        // abort reading if the pulse data array is full
> ++        if (data->num_pulses >= PD_MAX_PULSES) {
> ++            break;
> ++        }
> +     }
> +     //data->gap[data->num_pulses - 1] = 3000; // TODO: extend last gap?
> + 
> ++    // expand reapeats as long as the pulse data array has enough space
> +     unsigned pkt_pulses = data->num_pulses - prev_pulses;
> +     for (int i = 1; i < repeats && data->num_pulses + pkt_pulses <= PD_MAX_PULSES; ++i) {
> +         memcpy(&data->pulse[data->num_pulses], &data->pulse[prev_pulses], pkt_pulses * sizeof (*data->pulse));
> diff --git a/package/rtl_433/rtl_433.mk b/package/rtl_433/rtl_433.mk
> index 08735be850..fc6c2bece2 100644
> --- a/package/rtl_433/rtl_433.mk
> +++ b/package/rtl_433/rtl_433.mk
> @@ -10,6 +10,9 @@ RTL_433_LICENSE = GPL-2.0+
>  RTL_433_LICENSE_FILES = COPYING
>  RTL_433_CPE_ID_VALID = YES
>  
> +# 0002-Fix-overflow-in-rfraw-test-data-parsing.patch
> +RTL_433_IGNORE_CVES += CVE-2025-34450
> +
>  # Force Release build to remove ASAN.
>  RTL_433_CONF_OPTS = \
>  	-DCMAKE_BUILD_TYPE=Release \
> -- 
> 2.53.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot