espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-05 18:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[spinel] add bounds checks when decoding uint (#3459)

Browse Source
This commit is contained in:
Jonathan Hui
2019-01-16 00:16:58 -08:00
committed by GitHub
parent 107a4a2b43
commit 803168cf5a
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ncp/spinel.c
+4 -3
View File
@@ -46,6 +46,7 @@
#include "spinel.h"
#include <errno.h>
#include <limits.h>
#ifndef SPINEL_PLATFORM_HEADER
/* These are all already included in the spinel platform header
@@ -151,17 +152,17 @@ spinel_ssize_t spinel_packed_uint_decode(const uint8_t *bytes, spinel_size_t len
spinel_ssize_t ret = 0;
unsigned int value = 0;
int i = 0;
unsigned int i = 0;
do
{
if (len < sizeof(uint8_t))
if ((len < sizeof(uint8_t)) || (i >= sizeof(unsigned int) * CHAR_BIT))
{
ret = -1;
break;
}
value |= (unsigned int)((bytes[0] & 0x7F) << i);
value |= (unsigned int)(bytes[0] & 0x7F) << i;
i += 7;
ret += sizeof(uint8_t);
bytes += sizeof(uint8_t);