dandri/ZephCore
1
0
Fork 0
mirror of https://github.com/liquidraver/ZephCore.git synced 2026-09-02 14:33:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: buffer overflow, OOB read, packet leaks, BLE sign leak, USB timeout, atomics, fs_read checks

Browse Source 
- RegionMap::findMatch(): fix 1-byte stack overflow in tmp[] with bounded memcpy
- Packet::readFrom(): add bounds checks before reading transport codes
- Mesh::sendFlood(): release packet on TRACE type and invalid hash_size early returns
- CompanionMesh: add cleanupSignState() called from BLE disconnect to free sign buffer
- ZephyrCompanionUSB: add 2s timeout for partial V3 frames to prevent parser stall
- ui_mesh_actions: replace volatile bool with Zephyr atomic_t for cross-thread state
- CommonCLI: wrap ~40 fs_read() calls in prefs_read() helper with truncation warning
This commit is contained in:
liquidraver
2026-03-04 22:12:13 +01:00
parent a4e96fa6e6
commit d949ca4f6e
9 changed files with 764 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zephcore/src/Mesh.cpp
+4
View File
@@ -409,10 +409,12 @@ Packet *Mesh::createControlData(const uint8_t *data, size_t len)
void Mesh::sendFlood(Packet *packet, uint32_t delay_millis, uint8_t path_hash_size)
{
if (packet->getPayloadType() == PAYLOAD_TYPE_TRACE) {
releasePacket(packet);
return;
}
if (path_hash_size == 0 || path_hash_size > 3) {
LOG_WRN("sendFlood: invalid path_hash_size");
releasePacket(packet);
return;
}
packet->header &= ~PH_ROUTE_MASK;
@@ -434,10 +436,12 @@ void Mesh::sendFlood(Packet *packet, uint32_t delay_millis, uint8_t path_hash_si
void Mesh::sendFlood(Packet *packet, uint16_t *transport_codes, uint32_t delay_millis, uint8_t path_hash_size)
{
if (packet->getPayloadType() == PAYLOAD_TYPE_TRACE) {
releasePacket(packet);
return;
}
if (path_hash_size == 0 || path_hash_size > 3) {
LOG_WRN("sendFlood: invalid path_hash_size");
releasePacket(packet);
return;
}
packet->header &= ~PH_ROUTE_MASK;