espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-15 21:50:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

ncp-uart: Address possible buffer overflow and improve comments (#373)

Browse Source 
This is a follow up to #371.

This change slightly adjusts the logging logic in `NcpUart::HandleError`
to account for the trailing `"]\n\000"`.

This change also adds additional comments and replaces some magic values.
This commit is contained in:
Robert Quattlebaum
2016-08-12 16:22:18 -07:00
committed by Jonathan Hui
parent 09a407a961
commit cf55a4b3fc
2 changed files with 24 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ncp/hdlc.cpp
+7 -5
View File
@@ -241,21 +241,23 @@ void Decoder::Decode(const uint8_t *aInBuf, uint16_t aInLength)
break;
case kFlagSequence:
if (mOutOffset > 2)
// We ignore frames which are smaller
// than the size of the CRC check.
if (mOutOffset > sizeof(uint16_t))
{
if (mFcs == kGoodFcs)
{
mFrameHandler(mContext, mOutBuf, mOutOffset - 2);
mFrameHandler(mContext, mOutBuf, mOutOffset - sizeof(uint16_t));
}
else if (mErrorHandler != NULL)
{
mErrorHandler(mContext, kThreadError_Parse, mOutBuf, mOutOffset);
}
mOutOffset = 0;
mFcs = kInitFcs;
}
mOutOffset = 0;
mFcs = kInitFcs;
break;
default:
src/ncp/ncp_uart.cpp
+17 -3
View File
@@ -229,16 +229,30 @@ void NcpUart::HandleError(ThreadError aError, uint8_t *aBuf, uint16_t aBufLength
super_t::IncrementFrameErrorCounter();
// We can get away with sprintf because we know
// `hexbuf` is large enough.
sprintf(hexbuf, "Framing error %d: [", aError);
// Write out the first part of our log message.
otNcpStreamWrite(0, reinterpret_cast<uint8_t*>(hexbuf), static_cast<int>(strlen(hexbuf)));
for (i = 0; (i < aBufLength) && (i < 128/3); i++)
// The first '3' comes from the trailing "]\n\000" at the end o the string.
// The second '3' comes from the length of two hex digits and a space.
for (i = 0; (i < aBufLength) && (i < (sizeof(hexbuf) - 3) / 3); i++)
{
sprintf(&hexbuf[i*3], " %02X]\n", static_cast<uint8_t>(aBuf[i]));
// We can get away with sprintf because we know
// `hexbuf` is large enough, based on our calculations
// above.
sprintf(&hexbuf[i*3], " %02X", static_cast<uint8_t>(aBuf[i]));
}
otNcpStreamWrite(0, reinterpret_cast<uint8_t*>(hexbuf+1), static_cast<int>(strlen(hexbuf)-1));
// Append a final closing bracket and newline character
// so our log line looks nice.
sprintf(&hexbuf[i*3], "]\n");
// Write out the second part of our log message.
// We skip the first byte since it has a space in it.
otNcpStreamWrite(0, reinterpret_cast<uint8_t*>(hexbuf + 1), static_cast<int>(strlen(hexbuf) - 1));
}
} // namespace Thread