espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-31 08:07:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[network-data] add protection against memcpy() memory overwrite (#2125)

Browse Source
This commit is contained in:
Kamil Burzynski
2017-08-24 11:24:51 -07:00
committed by Jonathan Hui
parent 8b2e226874
commit d85bb5a2c1
5 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/api/border_router_api.cpp
+1 -1
View File
@@ -47,7 +47,7 @@ otError otBorderRouterGetNetData(otInstance *aInstance, bool aStable, uint8_t *a
VerifyOrExit(aData != NULL && aDataLength != NULL, error = OT_ERROR_INVALID_ARGS);
aInstance->mThreadNetif.GetNetworkDataLocal().GetNetworkData(aStable, aData, *aDataLength);
error = aInstance->mThreadNetif.GetNetworkDataLocal().GetNetworkData(aStable, aData, *aDataLength);
exit:
return error;
src/core/api/netdata_api.cpp
+1 -1
View File
@@ -44,7 +44,7 @@ otError otNetDataGet(otInstance *aInstance, bool aStable, uint8_t *aData, uint8_
VerifyOrExit(aData != NULL && aDataLength != NULL, error = OT_ERROR_INVALID_ARGS);
aInstance->mThreadNetif.GetNetworkDataLeader().GetNetworkData(aStable, aData, *aDataLength);
error = aInstance->mThreadNetif.GetNetworkDataLeader().GetNetworkData(aStable, aData, *aDataLength);
exit:
return error;
src/core/thread/mle.cpp
+3 -1
View File
@@ -1061,7 +1061,9 @@ otError Mle::AppendLeaderData(Message &aMessage)
void Mle::FillNetworkDataTlv(NetworkDataTlv &aTlv, bool aStableOnly)
{
uint8_t length;
uint8_t length = sizeof(NetworkDataTlv) - sizeof(Tlv); // sizeof( NetworkDataTlv::mNetworkData )
// Ignore result code, provided buffer must be enough
GetNetif().GetNetworkDataLeader().GetNetworkData(aStableOnly, aTlv.GetNetworkData(), length);
aTlv.SetLength(length);
}
src/core/thread/network_data.cpp
+7 -1
View File
@@ -66,9 +66,12 @@ void NetworkData::Clear(void)
mLength = 0;
}
void NetworkData::GetNetworkData(bool aStable, uint8_t *aData, uint8_t &aDataLength)
otError NetworkData::GetNetworkData(bool aStable, uint8_t *aData, uint8_t &aDataLength)
{
otError error = OT_ERROR_NONE;
assert(aData != NULL);
VerifyOrExit(aDataLength >= mLength, error = OT_ERROR_NO_BUFS);
memcpy(aData, mTlvs, mLength);
aDataLength = mLength;
@@ -77,6 +80,9 @@ void NetworkData::GetNetworkData(bool aStable, uint8_t *aData, uint8_t &aDataLen
{
RemoveTemporaryData(aData, aDataLength);
}
exit:
return error;
}
otError NetworkData::GetNextOnMeshPrefix(otNetworkDataIterator *aIterator, otBorderRouterConfig *aConfig)
src/core/thread/network_data.hpp
+5 -1
View File
@@ -114,8 +114,12 @@ public:
* @param[out] aData A pointer to the data buffer.
* @param[inout] aDataLength On entry, size of the data buffer pointed to by @p aData.
* On exit, number of copied bytes.
*
* @retval OT_ERROR_NONE Successfully copied full Thread Network Data.
* @retval OT_ERROR_NO_BUFS Not enough space to fully copy Thread Network Data.
*
*/
void GetNetworkData(bool aStable, uint8_t *aData, uint8_t &aDataLength);
otError GetNetworkData(bool aStable, uint8_t *aData, uint8_t &aDataLength);
/**
* This method provides the next On Mesh prefix in the Thread Network Data.