dandri/MeshCore
1
0
Fork 0
mirror of https://github.com/meshcore-dev/MeshCore.git synced 2026-08-14 09:29:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3107 from meshcore-dev/anon-req-fix

Browse Source 
bounds check added for anon_req reply_path_len
This commit is contained in:
Liam Cottle
2026-08-04 13:34:18 +12:00
committed by GitHub
parent d6c2da98aa 0fd11ed223
commit 8b9bee3bb7
2 changed files with 13 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/simple_repeater/MyMesh.cpp
+12 -16
View File
@@ -147,11 +147,10 @@ uint8_t MyMesh::handleLoginReq(const mesh::Identity& sender, const uint8_t* secr
uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
// request data has: {reply-path-len}{reply-path}
reply_path_len = *data & 63;
reply_path_hash_size = (*data >> 6) + 1;
data++;
reply_path_len = *data++;
if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0; // reject - bad encoding
memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
mesh::Packet::writePath(reply_path, data, reply_path_len);
// data += (uint8_t)reply_path_len * reply_path_hash_size;
memcpy(reply_data, &sender_timestamp, 4); // prefix with sender_timestamp, like a tag
@@ -166,11 +165,10 @@ uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t send
uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
// request data has: {reply-path-len}{reply-path}
reply_path_len = *data & 63;
reply_path_hash_size = (*data >> 6) + 1;
data++;
reply_path_len = *data++;
if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0; // reject - bad encoding
memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
mesh::Packet::writePath(reply_path, data, reply_path_len);
// data += (uint8_t)reply_path_len * reply_path_hash_size;
memcpy(reply_data, &sender_timestamp, 4); // prefix with sender_timestamp, like a tag
@@ -186,11 +184,10 @@ uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender
uint8_t MyMesh::handleAnonClockReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
// request data has: {reply-path-len}{reply-path}
reply_path_len = *data & 63;
reply_path_hash_size = (*data >> 6) + 1;
data++;
reply_path_len = *data++;
if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0; // reject - bad encoding
memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
mesh::Packet::writePath(reply_path, data, reply_path_len);
// data += (uint8_t)reply_path_len * reply_path_hash_size;
memcpy(reply_data, &sender_timestamp, 4); // prefix with sender_timestamp, like a tag
@@ -574,7 +571,7 @@ void MyMesh::onAnonDataRecv(mesh::Packet *packet, const uint8_t *secret, const m
data[len] = 0; // ensure null terminator
uint8_t reply_len;
reply_path_len = -1;
reply_path_len = 0xFF;
if (data[4] == 0 || data[4] >= ' ') { // is password, ie. a login request
reply_len = handleLoginReq(sender, secret, timestamp, &data[4], packet->isRouteFlood());
} else if (data[4] == ANON_REQ_TYPE_REGIONS && packet->isRouteDirect()) {
@@ -594,13 +591,12 @@ void MyMesh::onAnonDataRecv(mesh::Packet *packet, const uint8_t *secret, const m
mesh::Packet* path = createPathReturn(sender, secret, packet->path, packet->path_len,
PAYLOAD_TYPE_RESPONSE, reply_data, reply_len);
if (path) sendFloodReply(path, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
} else if (reply_path_len < 0) {
} else if (reply_path_len == 0xFF) {
mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
if (reply) sendFloodReply(reply, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
} else {
mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
uint8_t path_len = ((reply_path_hash_size - 1) << 6) | (reply_path_len & 63);
if (reply) sendDirect(reply, reply_path, path_len, SERVER_RESPONSE_DELAY);
if (reply) sendDirect(reply, reply_path, reply_path_len, SERVER_RESPONSE_DELAY);
}
}
}
examples/simple_repeater/MyMesh.h
+1 -2
View File
@@ -92,8 +92,7 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks {
CommonCLI _cli;
uint8_t reply_data[MAX_PACKET_PAYLOAD];
uint8_t reply_path[MAX_PATH_SIZE];
int8_t reply_path_len;
uint8_t reply_path_hash_size;
uint8_t reply_path_len;
TransportKeyStore key_store;
RegionMap region_map, temp_map;
RegionEntry* load_stack[8];