1
0
mirror of https://github.com/RIOT-OS/RIOT.git synced 2025-12-15 09:33:50 +01:00
Sören Tempel 06d572c2fc asymcute: fix one byte out-of-bounds access in _len_get
As per Section 5.2.1 of the MQTT-SN specification, the MQTT-SN length
header is either 1- or 3-octet long. If it is 3-octet long then the
first octet is 0x01. The asymcute implementation currently only checks
that the incoming packet is at least 2-octet long before attempting to
parse it (MIN_PKT_LEN). However, if the first octet is 0x01 the packet
must be more than 3 octet long in order to be valid. Since asymcute
does not check this it reads one octet beyond the packet data for a
2-octet packet where the first octet has the value 0x01. This commit
fixes this issue by adding an additional sanity check to _len_get.
2022-08-10 05:41:10 +02:00
..
2021-02-22 14:54:14 +01:00
2021-02-22 14:54:14 +01:00
2022-03-11 09:24:12 +01:00
2022-01-10 12:21:40 +01:00
2021-02-22 14:54:14 +01:00
2022-01-13 17:50:59 +01:00
2021-08-13 19:50:38 +02:00
2021-02-22 14:54:14 +01:00
2022-06-10 11:02:40 +02:00
2021-12-07 13:00:58 +01:00
2021-12-10 18:54:29 +01:00
2021-01-26 17:40:30 +01:00
2021-02-22 14:54:14 +01:00
2022-03-11 09:20:24 +01:00
2021-12-07 16:31:15 +01:00
2022-02-11 12:38:21 +01:00
2021-02-22 14:54:15 +01:00
2021-02-22 14:54:15 +01:00
2021-11-24 17:54:44 +01:00
2021-10-01 11:26:15 +02:00
2022-07-22 16:06:36 +02:00