From 89e7033830bd73a35f4bb2faf14ccf06f3785712 Mon Sep 17 00:00:00 2001 From: JF Date: Sun, 28 Jun 2020 11:59:14 +0200 Subject: Fix buffer overflow opportunities in AlertNotificationService & AlertNotificationClient. --- src/Components/Ble/AlertNotificationClient.cpp | 27 ++++++++++++++------ src/Components/Ble/AlertNotificationService.cpp | 34 ++++++++++++++----------- src/Components/Ble/NotificationManager.cpp | 7 ++--- src/Components/Ble/NotificationManager.h | 4 +-- 4 files changed, 44 insertions(+), 28 deletions(-) (limited to 'src/Components') diff --git a/src/Components/Ble/AlertNotificationClient.cpp b/src/Components/Ble/AlertNotificationClient.cpp index bf4d851c..b65e019d 100644 --- a/src/Components/Ble/AlertNotificationClient.cpp +++ b/src/Components/Ble/AlertNotificationClient.cpp @@ -105,14 +105,25 @@ int AlertNotificationClient::OnDescriptorDiscoveryEventCallback(uint16_t connect void AlertNotificationClient::OnNotification(ble_gap_event *event) { if(event->notify_rx.attr_handle == newAlertHandle) { - size_t notifSize = OS_MBUF_PKTLEN(event->notify_rx.om); - uint8_t data[notifSize + 1]; - data[notifSize] = '\0'; - os_mbuf_copydata(event->notify_rx.om, 0, notifSize, data); - char *s = (char *) &data[2]; - NRF_LOG_INFO("DATA : %s", s); - - notificationManager.Push(Pinetime::Controllers::NotificationManager::Categories::SimpleAlert, s, notifSize + 1); + // TODO implement this with more memory safety (and constexpr) + static const size_t maxBufferSize{21}; + static const size_t maxMessageSize{18}; + size_t bufferSize = min(OS_MBUF_PKTLEN(event->notify_rx.om), maxBufferSize); + + uint8_t data[bufferSize]; + os_mbuf_copydata(event->notify_rx.om, 0, bufferSize, data); + + char *s = (char *) &data[3]; + auto messageSize = min(maxMessageSize, (bufferSize-3)); + + for (int i = 0; i < messageSize-1; i++) { + if (s[i] == 0x00) { + s[i] = 0x0A; + } + } + s[messageSize-1] = '\0'; + + notificationManager.Push(Pinetime::Controllers::NotificationManager::Categories::SimpleAlert, s, messageSize); systemTask.PushMessage(Pinetime::System::SystemTask::Messages::OnNewNotification); } } diff --git a/src/Components/Ble/AlertNotificationService.cpp b/src/Components/Ble/AlertNotificationService.cpp index fd69bda3..0faa17c8 100644 --- a/src/Components/Ble/AlertNotificationService.cpp +++ b/src/Components/Ble/AlertNotificationService.cpp @@ -4,6 +4,7 @@ #include #include "AlertNotificationService.h" +#include using namespace Pinetime::Controllers; @@ -55,23 +56,26 @@ int AlertNotificationService::OnAlert(uint16_t conn_handle, uint16_t attr_handle struct ble_gatt_access_ctxt *ctxt) { if (ctxt->op == BLE_GATT_ACCESS_OP_WRITE_CHR) { - size_t notifSize = OS_MBUF_PKTLEN(ctxt->om); - uint8_t data[notifSize + 1]; - data[notifSize] = '\0'; - os_mbuf_copydata(ctxt->om, 0, notifSize, data); - char *s = (char *) &data[3]; - NRF_LOG_INFO("DATA : %s", s); + // TODO implement this with more memory safety (and constexpr) + static const size_t maxBufferSize{21}; + static const size_t maxMessageSize{18}; + size_t bufferSize = min(OS_MBUF_PKTLEN(ctxt->om), maxBufferSize); - for(int i = 0; i <= notifSize; i++) - { - if(s[i] == 0x00) - { - s[i] = 0x0A; - } - } + uint8_t data[bufferSize]; + os_mbuf_copydata(ctxt->om, 0, bufferSize, data); + + char *s = (char *) &data[3]; + auto messageSize = min(maxMessageSize, (bufferSize-3)); + + for (int i = 0; i < messageSize-1; i++) { + if (s[i] == 0x00) { + s[i] = 0x0A; + } + } + s[messageSize-1] = '\0'; - m_notificationManager.Push(Pinetime::Controllers::NotificationManager::Categories::SimpleAlert, s, notifSize + 1); - m_systemTask.PushMessage(Pinetime::System::SystemTask::Messages::OnNewNotification); + m_notificationManager.Push(Pinetime::Controllers::NotificationManager::Categories::SimpleAlert, s, messageSize); + m_systemTask.PushMessage(Pinetime::System::SystemTask::Messages::OnNewNotification); } return 0; } diff --git a/src/Components/Ble/NotificationManager.cpp b/src/Components/Ble/NotificationManager.cpp index 2e02cb15..0aea0697 100644 --- a/src/Components/Ble/NotificationManager.cpp +++ b/src/Components/Ble/NotificationManager.cpp @@ -4,11 +4,12 @@ using namespace Pinetime::Controllers; void NotificationManager::Push(Pinetime::Controllers::NotificationManager::Categories category, - const char *message, uint8_t messageSize) { + const char *message, uint8_t currentMessageSize) { // TODO handle edge cases on read/write index + auto checkedSize = std::min(currentMessageSize, uint8_t{18}); auto& notif = notifications[writeIndex]; - std::memcpy(notif.message.data(), message, messageSize); - notif.message[messageSize] = '\0'; + std::memcpy(notif.message.data(), message, checkedSize); + notif.message[checkedSize] = '\0'; notif.category = category; writeIndex = (writeIndex + 1 < TotalNbNotifications) ? writeIndex + 1 : 0; diff --git a/src/Components/Ble/NotificationManager.h b/src/Components/Ble/NotificationManager.h index 8edd6828..daa1571b 100644 --- a/src/Components/Ble/NotificationManager.h +++ b/src/Components/Ble/NotificationManager.h @@ -7,10 +7,10 @@ namespace Pinetime { class NotificationManager { public: enum class Categories {Unknown, SimpleAlert, Email, News, IncomingCall, MissedCall, Sms, VoiceMail, Schedule, HighProriotyAlert, InstantMessage }; - static constexpr uint8_t MessageSize = 18; + static constexpr uint8_t MessageSize{18}; struct Notification { - std::array message; + std::array message; Categories category = Categories::Unknown; }; -- cgit v1.2.3 From 6309719a62436fd746a7a8b228205e93b419ca26 Mon Sep 17 00:00:00 2001 From: JF Date: Sat, 11 Jul 2020 20:53:04 +0200 Subject: Set version to 0.7.0 --- CMakeLists.txt | 2 +- src/Components/Ble/DeviceInformationService.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'src/Components') diff --git a/CMakeLists.txt b/CMakeLists.txt index c5cf78aa..51ac2d18 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,5 +1,5 @@ cmake_minimum_required(VERSION 3.10) -project(pinetime VERSION 0.6.1 LANGUAGES C CXX ASM) +project(pinetime VERSION 0.7.0 LANGUAGES C CXX ASM) set(NRF_TARGET "nrf52") diff --git a/src/Components/Ble/DeviceInformationService.h b/src/Components/Ble/DeviceInformationService.h index 6249893d..d768da8e 100644 --- a/src/Components/Ble/DeviceInformationService.h +++ b/src/Components/Ble/DeviceInformationService.h @@ -25,7 +25,7 @@ namespace Pinetime { static constexpr char* manufacturerName = "Codingfield"; static constexpr char* modelNumber = "1"; static constexpr char* serialNumber = "9.8.7.6.5.4"; - static constexpr char* fwRevision = "0.5.0"; + static constexpr char* fwRevision = "0.7.0"; static constexpr char* hwRevision = "1.0.0"; static constexpr ble_uuid16_t deviceInfoUuid { -- cgit v1.2.3