dandri/ZephCore
1
0
Fork 0
mirror of https://github.com/liquidraver/ZephCore.git synced 2026-09-02 03:38:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

more small security fixes

Browse Source
This commit is contained in:
liquidraver
2026-04-30 09:53:03 +02:00
parent 62232bf609
commit e930d6cc9c
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zephcore/src/Mesh.cpp
+11 -2
View File
@@ -260,12 +260,21 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
if (pkt->getPayloadType() == PAYLOAD_TYPE_PATH) {
int k = 0;
uint8_t path_len = data[k++];
if (!Packet::isValidPathLen(path_len)) {
LOG_WRN("onRecvPacket: invalid inner path_len 0x%02x", path_len);
break;
}
uint8_t hash_size = (path_len >> 6) + 1;
uint8_t hash_count = path_len & 63;
uint8_t *path = &data[k]; k += hash_size*hash_count;
int path_bytes = hash_size * hash_count;
if (k + path_bytes + 1 > len) {
LOG_WRN("onRecvPacket: PATH payload truncated (k=%d path_bytes=%d len=%d)", k, path_bytes, len);
break;
}
uint8_t *path = &data[k]; k += path_bytes;
uint8_t extra_type = data[k++] & 0x0F;
uint8_t *extra = &data[k];
uint8_t extra_len = len - k;
uint8_t extra_len = (uint8_t)(len - k);
if (onPeerPathRecv(pkt, j, secret, path, path_len, extra_type, extra, extra_len)) {
if (pkt->isRouteFlood()) {
Packet *rpath = createPathReturn(&src_hash, secret, pkt->path, pkt->path_len, 0, nullptr, 0);
zephcore/src/Packet.cpp
+2 -2
View File
@@ -38,8 +38,8 @@ size_t Packet::writePath(uint8_t *dest, const uint8_t *src, uint8_t path_len)
uint8_t Packet::copyPath(uint8_t *dest, const uint8_t *src, uint8_t path_len)
{
writePath(dest, src, path_len);
return path_len;
size_t written = writePath(dest, src, path_len);
return written > 0 ? path_len : 0;
}
int Packet::getRawLength() const