espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-02 17:17:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mac] fix nullptr-with-nonzero-offset in ProcessEnhAckProbing (#12842)

Browse Source 
This commit fixes a nullptr-with-nonzero-offset runtime error in
Mac::ProcessEnhAckProbing. The error occurred because pointer
arithmetic was performed on the enhAckProbingIe pointer before
verifying if it was null.

The fix moves the pointer calculation after the null check to
ensure that it is only performed when a valid IE is present.

This was discovered by ASAN/UBSAN when processing frames without
the Enhancement ACK Probing IE.
This commit is contained in:
Jonathan Hui
2026-04-06 19:10:00 -05:00
committed by GitHub
parent f0cc2809cc
commit 7aa9d92600
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/mac/mac.cpp
+4 -4
View File
@@ -2530,16 +2530,16 @@ void Mac::ProcessEnhAckProbing(const RxFrame &aFrame, const Neighbor &aNeighbor)
const HeaderIe *enhAckProbingIe =
reinterpret_cast<const HeaderIe *>(aFrame.GetThreadIe(ThreadIe::kEnhAckProbingIe));
const uint8_t *data =
reinterpret_cast<const uint8_t *>(enhAckProbingIe) + sizeof(HeaderIe) + sizeof(VendorIeHeader);
uint8_t dataLen = 0;
uint8_t dataLen;
VerifyOrExit(enhAckProbingIe != nullptr);
dataLen = enhAckProbingIe->GetLength() - sizeof(VendorIeHeader);
VerifyOrExit(dataLen <= kEnhAckProbingIeMaxLen);
Get<LinkMetrics::Initiator>().ProcessEnhAckIeData(data, dataLen, aNeighbor);
Get<LinkMetrics::Initiator>().ProcessEnhAckIeData(reinterpret_cast<const uint8_t *>(enhAckProbingIe) +
sizeof(HeaderIe) + sizeof(VendorIeHeader),
dataLen, aNeighbor);
exit:
return;
}