Skip to content

Fix lwip_mac_address buffer overflow and set_ip_bytes out of bound access #3191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 10, 2016
Merged

Fix lwip_mac_address buffer overflow and set_ip_bytes out of bound access #3191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d039d30
lwip - Fix lwip_mac_address buffer overflow
tung7970 Nov 3, 2016
70ad0f5
netsocket - Fix set_ip_bytes out-of-bound access
tung7970 Nov 3, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions features/FEATURE_LWIP/lwip-interface/lwip_stack.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ static void mbed_lwip_socket_callback(struct netconn *nc, enum netconn_evt eh, u
/* TCP/IP and Network Interface Initialisation */
static struct netif lwip_netif;
static bool lwip_dhcp = false;
static char lwip_mac_address[NSAPI_MAC_SIZE] = "\0";
static char lwip_mac_address[NSAPI_MAC_SIZE];

#if !LWIP_IPV4 || !LWIP_IPV6
static bool all_zeros(const uint8_t *p, int len)
Expand Down Expand Up @@ -309,13 +309,13 @@ static void mbed_lwip_netif_status_irq(struct netif *lwip_netif)
static void mbed_lwip_set_mac_address(void)
{
#if (MBED_MAC_ADDRESS_SUM != MBED_MAC_ADDR_INTERFACE)
snprintf(lwip_mac_address, 19, "%02x:%02x:%02x:%02x:%02x:%02x",
snprintf(lwip_mac_address, NSAPI_MAC_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x",
MBED_MAC_ADDR_0, MBED_MAC_ADDR_1, MBED_MAC_ADDR_2,
MBED_MAC_ADDR_3, MBED_MAC_ADDR_4, MBED_MAC_ADDR_5);
#else
char mac[6];
mbed_mac_address(mac);
snprintf(lwip_mac_address, 19, "%02x:%02x:%02x:%02x:%02x:%02x",
snprintf(lwip_mac_address, NSAPI_MAC_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x",
mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
#endif
}
Expand Down
8 changes: 7 additions & 1 deletion features/netsocket/SocketAddress.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,8 +203,14 @@ bool SocketAddress::set_ip_address(const char *addr)
void SocketAddress::set_ip_bytes(const void *bytes, nsapi_version_t version)
{
nsapi_addr_t addr;

addr = nsapi_addr_t();
addr.version = version;
memcpy(addr.bytes, bytes, NSAPI_IP_BYTES);
if (version == NSAPI_IPv6) {
memcpy(addr.bytes, bytes, NSAPI_IPv6_BYTES);
} else if (version == NSAPI_IPv4) {
memcpy(addr.bytes, bytes, NSAPI_IPv4_BYTES);
}
set_addr(addr);
}

Expand Down