espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-01 16:47:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overrun issues when processing URI Paths. (#928)

Browse Source
This commit is contained in:
Jonathan Hui
2016-11-04 08:47:36 -07:00
committed by GitHub
parent 91eb6f507f
commit d624bcb1c1
3 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/coap/coap_server.cpp
+10 -5
View File
@@ -109,7 +109,7 @@ void Server::HandleUdpReceive(void *aContext, otMessage aMessage, const otMessag
void Server::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
{
Header header;
char uriPath[kMaxReceivedUriPath];
char uriPath[Resource::kMaxReceivedUriPath] = "";
char *curUriPath = uriPath;
const Header::Option *coapOption;
@@ -123,10 +123,15 @@ void Server::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessag
switch (coapOption->mNumber)
{
case kCoapOptionUriPath:
VerifyOrExit(coapOption->mLength < sizeof(uriPath) - static_cast<size_t>(curUriPath - uriPath), ;);
if (curUriPath != uriPath)
{
*curUriPath++ = '/';
}
VerifyOrExit(coapOption->mLength < sizeof(uriPath) - static_cast<size_t>(curUriPath + 1 - uriPath), ;);
memcpy(curUriPath, coapOption->mValue, coapOption->mLength);
curUriPath[coapOption->mLength] = '/';
curUriPath += coapOption->mLength + 1;
curUriPath += coapOption->mLength;
break;
case kCoapOptionContentFormat:
@@ -139,7 +144,7 @@ void Server::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessag
coapOption = header.GetNextOption();
}
curUriPath[-1] = '\0';
curUriPath[0] = '\0';
for (Resource *resource = mResources; resource; resource = resource->mNext)
{
src/core/coap/coap_server.hpp
+5 -5
View File
@@ -57,6 +57,11 @@ class Resource
friend class Server;
public:
enum
{
kMaxReceivedUriPath = 32, ///< Maximum supported URI path on received messages.
};
/**
* This function pointer is called when a CoAP message with a given Uri-Path is received.
*
@@ -168,11 +173,6 @@ public:
ThreadError SendMessage(Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
private:
enum
{
kMaxReceivedUriPath = 32, ///< Maximum supported URI path on received messages.
};
static void HandleUdpReceive(void *aContext, otMessage aMessage, const otMessageInfo *aMessageInfo);
void HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
src/core/meshcop/commissioner.cpp
+10 -8
View File
@@ -868,7 +868,7 @@ void Commissioner::ReceiveJoinerFinalize(uint8_t *buf, uint16_t length)
{
Message *message = NULL;
Coap::Header header;
char uriPath[16];
char uriPath[Coap::Resource::kMaxReceivedUriPath] = "";
char *curUriPath = uriPath;
const Coap::Header::Option *coapOption;
@@ -890,10 +890,15 @@ void Commissioner::ReceiveJoinerFinalize(uint8_t *buf, uint16_t length)
switch (coapOption->mNumber)
{
case kCoapOptionUriPath:
VerifyOrExit(coapOption->mLength < sizeof(uriPath) - static_cast<uint16_t>(curUriPath - uriPath), ;);
if (curUriPath != uriPath)
{
*curUriPath++ = '/';
}
VerifyOrExit(coapOption->mLength < sizeof(uriPath) - static_cast<size_t>(curUriPath + 1 - uriPath), ;);
memcpy(curUriPath, coapOption->mValue, coapOption->mLength);
curUriPath[coapOption->mLength] = '/';
curUriPath += coapOption->mLength + 1;
curUriPath += coapOption->mLength;
break;
case kCoapOptionContentFormat:
@@ -906,10 +911,7 @@ void Commissioner::ReceiveJoinerFinalize(uint8_t *buf, uint16_t length)
coapOption = header.GetNextOption();
}
if (curUriPath > uriPath)
{
curUriPath[-1] = '\0';
}
curUriPath[0] = '\0';
VerifyOrExit(strcmp(uriPath, OPENTHREAD_URI_JOINER_FINALIZE) == 0,);