dandri/ZephCore
1
0
Fork 0
mirror of https://github.com/liquidraver/ZephCore.git synced 2026-09-02 02:39:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): close OOB read in path-decoding callers (BLE + LoRa-anon)

Browse Source 
Both mesh::Packet::writePath and ::copyPath did a raw memcpy of the
decoded hash_count*hash_size bytes from src to dest with no bound on
src. Two call sites used phone-supplied or LoRa-anon-supplied buffers
where the path_len byte was attacker-controlled:

  - CompanionMesh CMD_SEND_CHANNEL_DATA accepted len>=4 and called
    writePath with no src bound; a paired phone could leak up to ~65
    bytes of syswq stack into the outgoing LoRa channel-data frame.

  - RepeaterMesh handleAnonRegionsReq / handleAnonOwnerReq /
    handleAnonClockReq read reply_path_len from an unauthenticated
    LoRa anon-request payload and called copyPath without any src
    bound. Any LoRa neighbor could leak repeater stack into the
    reply path.

Hardened the API: both functions now require an explicit src_len
and reject (return 0) when the decoded byte count exceeds it.
Updated all 14 call sites across Packet/Mesh/Dispatcher/BaseChatMesh/
CompanionMesh/RepeaterMesh. Trusted callers (internal MAX_PATH_SIZE
buffers) pass MAX_PATH_SIZE; untrusted callers pass real remaining
length. Added len-5 plumbing through the anon-handler signatures.

CMD_SEND_CHANNEL_DATA also gained a local len>=5 + path_bytes
sanity check for early rejection.
This commit is contained in:
liquidraver
2026-05-20 11:52:39 +02:00
parent d7e420bf2f
commit bd1e022e88
8 changed files with 86 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zephcore/helpers/BaseChatMesh.cpp
+4 -1
View File
@@ -335,7 +335,10 @@ bool BaseChatMesh::onPeerPathRecv(mesh::Packet *packet, int sender_idx, const ui
bool BaseChatMesh::onContactPathRecv(ContactInfo &from, uint8_t *in_path, uint8_t in_path_len,
uint8_t *out_path, uint8_t out_path_len, uint8_t extra_type, uint8_t *extra, uint8_t extra_len)
{
from.out_path_len = mesh::Packet::copyPath(from.out_path, out_path, out_path_len);
/* out_path is from the inner payload of a validated LoRa packet (caller path).
* Existing contract is that the upstream parser bounds the available bytes;
* pass MAX_PATH_SIZE to preserve behavior while making the bound explicit. */
from.out_path_len = mesh::Packet::copyPath(from.out_path, out_path, MAX_PATH_SIZE, out_path_len);
from.lastmod = getRTCClock()->getCurrentTime();
onContactPathUpdated(from);