g4klx/DMRGateway
1
0
Fork 0
mirror of https://github.com/g4klx/DMRGateway.git synced 2026-04-06 06:53:40 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix heap buffer overflow on DMRG/DMRA packets

Browse source 
Incoming DMRG and DMRA packets were copied into 50-byte buffers
without checking the packet length. UDP reads can return up to 500
bytes, overflowing the heap allocation. Drop oversized packets.
This commit is contained in:
Ember 2026-04-04 16:49:19 -07:00
parent 0e04ebae0f
commit f697c1de8c
1 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
MMDVMNetwork.cpp
View file

@ -276,11 +276,15 @@ void CMMDVMNetwork::clock(unsigned int ms)
m_rxData.addData(&len, 1U);
m_rxData.addData(m_buffer, len);
} else if (::memcmp(m_buffer, "DMRG", 4U) == 0) {
::memcpy(m_radioPositionData, m_buffer, length);
m_radioPositionLen = length;
if (length <= 50U) {
::memcpy(m_radioPositionData, m_buffer, length);
m_radioPositionLen = length;
}
} else if (::memcmp(m_buffer, "DMRA", 4U) == 0) {
::memcpy(m_talkerAliasData, m_buffer, length);
m_talkerAliasLen = length;
if (length <= 50U) {
::memcpy(m_talkerAliasData, m_buffer, length);
m_talkerAliasLen = length;
}
} else if (::memcmp(m_buffer, "DMRC", 4U) == 0) {
m_id = (m_buffer[4U] << 24) | (m_buffer[5U] << 16) | (m_buffer[6U] << 8) | (m_buffer[7U] << 0);