From 9aa7340eb28c3ea6dfacd4d4917a326fdb85ebe7 Mon Sep 17 00:00:00 2001 From: "Duda, Lukasz" Date: Fri, 8 May 2020 22:46:00 +0200 Subject: [PATCH] [ncp] ensure IPv6 packet length does not exceed maximum size of SPINEL command payload (#4940) With the current code, it is possible that NCP tries to send IPv6 packet larger than the maximum size of SPINEL command payload. This commit adds additional defines to spinel.h and proper checks in NCP codebase. --- src/lib/spinel/spinel.h | 22 ++++++++++++++++++++++ src/ncp/ncp_base_mtd.cpp | 3 +++ 2 files changed, 25 insertions(+) diff --git a/src/lib/spinel/spinel.h b/src/lib/spinel/spinel.h index 1c0970077..c15968d1d 100644 --- a/src/lib/spinel/spinel.h +++ b/src/lib/spinel/spinel.h @@ -345,8 +345,30 @@ #define SPINEL_PROTOCOL_VERSION_THREAD_MAJOR 4 #define SPINEL_PROTOCOL_VERSION_THREAD_MINOR 3 +/** + * @def SPINEL_FRAME_MAX_SIZE + * + * The maximum size of SPINEL frame. + * + */ #define SPINEL_FRAME_MAX_SIZE 1300 +/** + * @def SPINEL_FRAME_MAX_COMMAND_HEADER_SIZE + * + * The maximum size of SPINEL command header. + * + */ +#define SPINEL_FRAME_MAX_COMMAND_HEADER_SIZE 4 + +/** + * @def SPINEL_FRAME_MAX_PAYLOAD_SIZE + * + * The maximum size of SPINEL command payload. + * + */ +#define SPINEL_FRAME_MAX_COMMAND_PAYLOAD_SIZE (SPINEL_FRAME_MAX_SIZE - SPINEL_FRAME_MAX_COMMAND_HEADER_SIZE) + /** * @def SPINEL_ENCRYPTER_EXTRA_DATA_SIZE * diff --git a/src/ncp/ncp_base_mtd.cpp b/src/ncp/ncp_base_mtd.cpp index f694deb7b..25efa03fa 100644 --- a/src/ncp/ncp_base_mtd.cpp +++ b/src/ncp/ncp_base_mtd.cpp @@ -3397,6 +3397,9 @@ void NcpBase::HandleDatagramFromStack(otMessage *aMessage) { VerifyOrExit(aMessage != NULL, OT_NOOP); + // Do not forward frames larger than SPINEL payload size. + VerifyOrExit(otMessageGetLength(aMessage) <= SPINEL_FRAME_MAX_COMMAND_PAYLOAD_SIZE, otMessageFree(aMessage)); + otMessageQueueEnqueue(&mMessageQueue, aMessage); // If there is no queued spinel command response, try to write/send