espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-09 10:40:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add input validation and fix memory access issues. (#164)

Browse Source
This commit is contained in:
Jonathan Hui
2016-06-17 10:03:49 -07:00
committed by GitHub
parent dae1d3801d
commit 0a45e89955
6 changed files with 34 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/mac/mac_frame.hpp
+2 -1
View File
@@ -735,8 +735,9 @@ public:
*
*/
void SetNetworkName(const char *aNetworkName) {
int length = strnlen(aNetworkName, sizeof(mNetworkName));
memset(mNetworkName, 0, sizeof(mNetworkName));
strncpy(mNetworkName, aNetworkName, sizeof(mNetworkName));
memcpy(mNetworkName, aNetworkName, length);
}
/**
src/core/mac/mac_whitelist.cpp
+1 -1
View File
@@ -87,7 +87,7 @@ Whitelist::Entry *Whitelist::Add(const ExtAddress &address)
continue;
}
memcpy(&mWhitelist[i], &address, sizeof(mWhitelist[i]));
memcpy(&mWhitelist[i].mExtAddress, &address, sizeof(mWhitelist[i].mExtAddress));
mWhitelist[i].mValid = true;
mWhitelist[i].mConstantRssi = false;
ExitNow(rval = &mWhitelist[i]);
src/core/thread/mesh_forwarder.cpp
+4 -1
View File
@@ -450,6 +450,7 @@ ThreadError MeshForwarder::UpdateIp6Route(Message &aMessage)
{
ThreadError error = kThreadError_None;
Ip6::Header ip6Header;
uint16_t rloc16;
Neighbor *neighbor;
mAddMeshHeader = false;
@@ -469,7 +470,9 @@ ThreadError MeshForwarder::UpdateIp6Route(Message &aMessage)
// FFD - peform full routing
if (mMle.IsRoutingLocator(ip6Header.GetDestination()))
{
mMeshDest = HostSwap16(ip6Header.GetDestination().m16[7]);
rloc16 = HostSwap16(ip6Header.GetDestination().m16[7]);
VerifyOrExit(mMle.GetRouterId(rloc16) < Mle::kMaxRouterId, error = kThreadError_Drop);
mMeshDest = rloc16;
}
else if ((neighbor = mMle.GetNeighbor(ip6Header.GetDestination())) != NULL)
{
src/core/thread/mle.hpp
+2 -2
View File
@@ -278,7 +278,7 @@ public:
*
*/
Command GetCommand(void) const {
const uint8_t *command = mKeyIdentifier + (IsKeyIdMode1() ? 1 : 5);
const uint8_t *command = IsKeyIdMode1() ? mKeyIdentifier + 1 : &mCommand;
return static_cast<Command>(*command);
}
@@ -289,7 +289,7 @@ public:
*
*/
void SetCommand(Command aCommand) {
uint8_t *commandField = mKeyIdentifier + (IsKeyIdMode1() ? 1 : 5);
uint8_t *commandField = IsKeyIdMode1() ? mKeyIdentifier + 1 : &mCommand;
*commandField = static_cast<uint8_t>(aCommand);
}
src/core/thread/mle_router.cpp
+19 -10
View File
@@ -802,7 +802,7 @@ ThreadError MleRouter::HandleLinkAccept(const Message &aMessage, const Ip6::Mess
mleFrameCounter.SetFrameCounter(linkFrameCounter.GetFrameCounter());
}
routerId = GetRouterId(sourceAddress.GetRloc16());
VerifyOrExit((routerId = GetRouterId(sourceAddress.GetRloc16())) < kMaxRouterId, error = kThreadError_Parse);
if (routerId != mRouterId)
{
@@ -1134,7 +1134,8 @@ ThreadError MleRouter::HandleAdvertisement(const Message &aMessage, const Ip6::M
SuccessOrExit(error = ProcessRouteTlv(route));
}
routerId = GetRouterId(sourceAddress.GetRloc16());
VerifyOrExit((routerId = GetRouterId(sourceAddress.GetRloc16())) < kMaxRouterId, error = kThreadError_Parse);
router = NULL;
switch (GetDeviceState())
@@ -2164,21 +2165,26 @@ exit:
uint16_t MleRouter::GetNextHop(uint16_t aDestination) const
{
uint8_t nexthop;
uint16_t nextHopRloc16 = Mac::kShortAddrInvalid;
uint8_t nextHopRouterId;
uint8_t routerId;
if (mDeviceState == kDeviceStateChild)
{
return Mle::GetNextHop(aDestination);
ExitNow(nextHopRloc16 = Mle::GetNextHop(aDestination));
}
nexthop = mRouters[GetRouterId(aDestination)].mNextHop;
routerId = GetRouterId(aDestination);
if (nexthop == kMaxRouterId || mRouters[nexthop].mState == Neighbor::kStateInvalid)
if (routerId < kMaxRouterId)
{
return Mac::kShortAddrInvalid;
nextHopRouterId = mRouters[routerId].mNextHop;
VerifyOrExit(nextHopRouterId != kMaxRouterId && mRouters[nextHopRouterId].mState != Neighbor::kStateInvalid, ;);
nextHopRloc16 = GetRloc16(mRouters[nextHopRouterId].mNextHop);
}
return GetRloc16(nexthop);
exit:
return nextHopRloc16;
}
uint8_t MleRouter::GetRouteCost(uint16_t aRloc16) const
@@ -2406,6 +2412,7 @@ void MleRouter::HandleAddressSolicitResponse(Message &aMessage)
ThreadStatusTlv statusTlv;
ThreadRloc16Tlv rlocTlv;
ThreadRouterMaskTlv routerMaskTlv;
uint8_t routerId;
bool old;
SuccessOrExit(header.FromMessage(aMessage));
@@ -2423,12 +2430,13 @@ void MleRouter::HandleAddressSolicitResponse(Message &aMessage)
SuccessOrExit(ThreadTlv::GetTlv(aMessage, ThreadTlv::kRloc16, sizeof(rlocTlv), rlocTlv));
VerifyOrExit(rlocTlv.IsValid(), ;);
VerifyOrExit((routerId = GetRouterId(rlocTlv.GetRloc16())) < kMaxRouterId, ;);
SuccessOrExit(ThreadTlv::GetTlv(aMessage, ThreadTlv::kRouterMask, sizeof(routerMaskTlv), routerMaskTlv));
VerifyOrExit(routerMaskTlv.IsValid(), ;);
// assign short address
mRouterId = GetRouterId(rlocTlv.GetRloc16());
mRouterId = routerId;
mPreviousRouterId = mRouterId;
SuccessOrExit(SetStateRouter(GetRloc16(mRouterId)));
mRouters[mRouterId].mCost = 0;
@@ -2639,7 +2647,8 @@ void MleRouter::HandleAddressRelease(Coap::Header &aHeader, Message &aMessage,
SuccessOrExit(error = ThreadTlv::GetTlv(aMessage, ThreadTlv::kExtMacAddress, sizeof(macAddr64Tlv), macAddr64Tlv));
VerifyOrExit(macAddr64Tlv.IsValid(), error = kThreadError_Parse);
routerId = GetRouterId(rlocTlv.GetRloc16());
VerifyOrExit((routerId = GetRouterId(rlocTlv.GetRloc16())) < kMaxRouterId, error = kThreadError_Parse);
router = &mRouters[routerId];
VerifyOrExit(memcmp(&router->mMacAddr, macAddr64Tlv.GetMacAddr(), sizeof(router->mMacAddr)) == 0, ;);
src/core/thread/network_data.cpp
+6 -1
View File
@@ -149,7 +149,12 @@ void NetworkData::RemoveTemporaryData(uint8_t *aData, uint8_t &aDataLength, Pref
case NetworkDataTlv::kTypeBorderRouter:
{
borderRouter = FindBorderRouter(aPrefix);
context = FindContext(aPrefix);
if ((context = FindContext(aPrefix)) == NULL)
{
break;
}
contextId = context->GetContextId();
// replace p_border_router_16