diff options
| author | Brant Thomsen <brant.thomsen@harman.com> | 2017-07-19 17:16:54 -0600 |
|---|---|---|
| committer | Brant Thomsen <brant.thomsen@harman.com> | 2017-07-19 17:16:54 -0600 |
| commit | d1108941e160b90928bfb7fa3bb2150bf214be90 (patch) | |
| tree | d39e476245c2ab6e19d7b6373cd8d49b42fb7b7d | |
| parent | 8721f5174965ca319954d0cc64e6887eb8173d71 (diff) | |
| download | Open-AVB-d1108941e160b90928bfb7fa3bb2150bf214be90.tar.gz | |
Check AECP frame length
If the data we extract from a frame is larger than the supplied frame itself,
ignore the frame.
Also fixed a potential memory leak.
| -rw-r--r-- | lib/avtp_pipeline/aecp/openavb_aecp_message.c | 12 | ||||
| -rw-r--r-- | lib/avtp_pipeline/aecp/openavb_aecp_sm_entity_model_entity.c | 2 |
2 files changed, 10 insertions, 4 deletions
diff --git a/lib/avtp_pipeline/aecp/openavb_aecp_message.c b/lib/avtp_pipeline/aecp/openavb_aecp_message.c index 12dd66c3..b2e55bee 100644 --- a/lib/avtp_pipeline/aecp/openavb_aecp_message.c +++ b/lib/avtp_pipeline/aecp/openavb_aecp_message.c @@ -507,9 +507,15 @@ static void openavbAecpMessageRxFrameParse(U8* payload, int payload_len, hdr_inf break;
}
- // Notify the state machine of the command request
- // The buffer will be deleted once the request is handled.
- openavbAecpSMEntityModelEntitySet_rcvdCommand(openavbAecpCommandResponse);
+ if (pSrc - payload <= payload_len) {
+ // Notify the state machine of the command request
+ // The buffer will be deleted once the request is handled.
+ openavbAecpSMEntityModelEntitySet_rcvdCommand(openavbAecpCommandResponse);
+ }
+ else {
+ AVB_LOGF_ERROR("Expected packet of size %d, but received one of size %d. Discarding.", pSrc - payload, payload_len);
+ free(openavbAecpCommandResponse);
+ }
}
AVB_TRACE_EXIT(AVB_TRACE_AECP);
diff --git a/lib/avtp_pipeline/aecp/openavb_aecp_sm_entity_model_entity.c b/lib/avtp_pipeline/aecp/openavb_aecp_sm_entity_model_entity.c index d48c7cdb..5f125244 100644 --- a/lib/avtp_pipeline/aecp/openavb_aecp_sm_entity_model_entity.c +++ b/lib/avtp_pipeline/aecp/openavb_aecp_sm_entity_model_entity.c @@ -1191,7 +1191,7 @@ void openavbAecpSMEntityModelEntitySet_rcvdCommand(openavb_aecp_AEMCommandRespon openavbAecpSMGlobalVars.myEntityID,
sizeof(openavbAecpSMGlobalVars.myEntityID)) != 0) {
// Not intended for us.
- free(openavbAecpSMEntityModelEntityVars.rcvdCommand);
+ free(rcvdCommand);
return;
}
|