dandri/ZephCore
1
0
Fork 0
mirror of https://github.com/liquidraver/ZephCore.git synced 2026-09-09 15:25:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

guard TRACE path append, multi-ack len, runt flood ACK (core-mesh audit)

Browse Source
This commit is contained in:
liquidraver
2026-06-11 08:43:00 +02:00
parent 0ce847b9bb
commit a03390baa7
2 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zephcore/src/Mesh.cpp
+19 -6
View File
@@ -277,11 +277,15 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
switch (pkt->getPayloadType()) {
case PAYLOAD_TYPE_ACK: {
uint32_t ack_crc;
memcpy(&ack_crc, pkt->payload, 4);
if (!_tables->hasSeen(pkt)) {
onAckRecv(pkt, ack_crc);
action = routeRecvPacket(pkt);
if (pkt->payload_len < 4) {
LOG_WRN("onRecvPacket: incomplete ACK (payload_len=%d)", pkt->payload_len);
} else {
uint32_t ack_crc;
memcpy(&ack_crc, pkt->payload, 4);
if (!_tables->hasSeen(pkt)) {
onAckRecv(pkt, ack_crc);
action = routeRecvPacket(pkt);
}
}
break;
}
@@ -499,6 +503,7 @@ Packet *Mesh::createAck(const uint8_t *ack, uint8_t len)
Packet *Mesh::createMultiAck(const uint8_t *ack, uint8_t len, uint8_t remaining)
{
if (1 + (size_t)len > MAX_PACKET_PAYLOAD) return nullptr;
Packet *packet = obtainNewPacket();
if (packet == nullptr) return nullptr;
packet->header = (PAYLOAD_TYPE_MULTIPART << PH_TYPE_SHIFT);
@@ -594,7 +599,15 @@ void Mesh::sendDirect(Packet *packet, const uint8_t *path, uint8_t path_len, uin
uint8_t pri;
if (packet->getPayloadType() == PAYLOAD_TYPE_TRACE) {
/* For TRACE packets, path is appended to end of PAYLOAD (used for SNRs) */
/* For TRACE packets, path is appended to end of PAYLOAD (used for SNRs).
* Guard the append: a crafted CMD_SEND_TRACE_PATH frame can set a
* non-standard path hash size (path_sz 2/3) that the caller's hop-count
* validation doesn't byte-bound, so payload_len + path_len could spill
* past payload[]. */
if ((int)packet->payload_len + path_len > MAX_PACKET_PAYLOAD) {
releasePacket(packet);
return;
}
memcpy(&packet->payload[packet->payload_len], path, path_len);
packet->payload_len += path_len;
packet->path_len = 0;