Repository navigation
Conversation
Radio frames can arrive with short or zero-length payloads in pooled Packet buffers that retain stale bytes, and AES-decrypted payloads are only block-aligned rather than guaranteed to hold variable-length inner fields: - Require a full 9-byte TRACE header before subtracting the header size (preventing uint8_t len underflow) and ensure a complete hop hash remains before matching self_id. - Require payload_len > 0 before reading pkt->payload[0] on direct CONTROL frames so pooled buffer remnants do not trigger empty control callbacks. - Reject PAYLOAD_TYPE_PATH frames whose encoded path plus extra_type byte exceed the decrypted payload length before uint8_t extra_len underflows and passes stack memory into onPeerPathRecv(). - Bound MyMesh::onContactResponse() against short piggybacked PATH responses (preserving 8-12 byte legacy login responses by defaulting missing FIRMWARE_VER_LEVEL to 0) and clamp len to MAX_FRAME_SIZE - 4 so max-size responses neither overrun out_frame[] nor exceed writeFrame()'s frame limit.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add missing payload length checks on the receive path in Mesh::onRecvPacket() and companion_radio's MyMesh::onContactResponse().
In MyMesh::onContactResponse(), check len before reading tag and piggybacked login response fields (defaulting FIRMWARE_VER_LEVEL to 0 when len < 13 so 8-12 byte legacy login replies still work), and clamp len to MAX_FRAME_SIZE - 4 (172) so 176-byte decrypted responses do not write past out_frame[177] or get dropped by writeFrame().
Disclosure: spotted during an AI-assisted review; I manually checked each guard against the packet layouts, reproduced the out-of-bounds cases before/after in a local AddressSanitizer harness, and verified builds for RAK_4631 and Heltec_v3 along with pio test -e native.