Skip to content

Commit bb5787a

Browse files
devytedevyte
authored
Fix mdns buffer overrun by 1 (#4317)
* fix mdns buffer overflow, minor indent/prettify
1 parent 85fb3d9 commit bb5787a

File tree

1 file changed

+60
-42
lines changed

1 file changed

+60
-42
lines changed

‎libraries/ESP8266mDNS/ESP8266mDNS.cpp

Lines changed: 60 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -94,10 +94,10 @@ static const int MDNS_PORT = 5353;
9494
struct MDNSService {
9595
MDNSService* _next;
9696
char _name[32];
97-
char _proto[3];
97+
char _proto[4];
9898
uint16_t _port;
99-
struct MDNSTxt * _txts;
10099
uint16_t _txtLen; // length of all txts
100+
struct MDNSTxt * _txts;
101101
};
102102

103103
struct MDNSTxt{
@@ -213,30 +213,31 @@ bool MDNSResponder::_listen() {
213213
}
214214

215215
void MDNSResponder::update() {
216-
if (!_conn || !_conn->next()) {
216+
if (!_conn || !_conn->next())
217217
return;
218-
}
219218
_parsePacket();
220219
}
221220

222221

223222
void MDNSResponder::setInstanceName(String name){
224-
if (name.length() > 63) return;
225-
else _instanceName = name;
223+
if (name.length() > 63)
224+
return;
225+
_instanceName = name;
226226
}
227227

228228

229229
bool MDNSResponder::addServiceTxt(char *name, char *proto, char *key, char *value){
230230
MDNSService* servicePtr;
231231

232232
uint8_t txtLen = os_strlen(key) + os_strlen(value) + 1; // Add one for equals sign
233-
txtLen+=1; //accounts for length byte added when building the txt responce
233+
txtLen += 1; //accounts for length byte added when building the txt responce
234234
//Find the service
235235
for (servicePtr = _services; servicePtr; servicePtr = servicePtr->_next) {
236236
//Checking Service names
237-
if(strcmp(servicePtr->_name, name) == 0 && strcmp(servicePtr->_proto, proto) == 0){
237+
if(strcmp(servicePtr->_name, name) == 0 && strcmp(servicePtr->_proto, proto) == 0) {
238238
//found a service name match
239-
if (servicePtr->_txtLen + txtLen > 1300) return false; //max txt record size
239+
if (servicePtr->_txtLen + txtLen > 1300)
240+
return false; //max txt record size
240241
MDNSTxt *newtxt = new MDNSTxt;
241242
newtxt->_txt = String(key) + "=" + String(value);
242243
newtxt->_next = 0;
@@ -245,10 +246,9 @@ bool MDNSResponder::addServiceTxt(char *name, char *proto, char *key, char *valu
245246
servicePtr->_txts = newtxt;
246247
servicePtr->_txtLen += txtLen;
247248
return true;
248-
}
249-
else{
249+
} else {
250250
MDNSTxt * txtPtr = servicePtr->_txts;
251-
while(txtPtr->_next !=0) {
251+
while(txtPtr->_next != 0) {
252252
txtPtr = txtPtr->_next;
253253
}
254254
//adding another TXT to service
@@ -262,8 +262,10 @@ bool MDNSResponder::addServiceTxt(char *name, char *proto, char *key, char *valu
262262
}
263263

264264
void MDNSResponder::addService(char *name, char *proto, uint16_t port){
265-
if(_getServicePort(name, proto) != 0) return;
266-
if(os_strlen(name) > 32 || os_strlen(proto) != 3) return; //bad arguments
265+
if(_getServicePort(name, proto) != 0)
266+
return;
267+
if(os_strlen(name) > 32 || os_strlen(proto) != 3)
268+
return; //bad arguments
267269
struct MDNSService *srv = (struct MDNSService*)(os_malloc(sizeof(struct MDNSService)));
268270
os_strcpy(srv->_name, name);
269271
os_strcpy(srv->_proto, proto);
@@ -272,10 +274,12 @@ void MDNSResponder::addService(char *name, char *proto, uint16_t port){
272274
srv->_txts = 0;
273275
srv->_txtLen = 0;
274276

275-
if(_services == 0) _services = srv;
276-
else{
277+
if(_services == 0) {
278+
_services = srv;
279+
} else {
277280
MDNSService* servicePtr = _services;
278-
while(servicePtr->_next !=0) servicePtr = servicePtr->_next;
281+
while(servicePtr->_next != 0)
282+
servicePtr = servicePtr->_next;
279283
servicePtr->_next = srv;
280284
}
281285

@@ -420,10 +424,9 @@ MDNSTxt * MDNSResponder::_getServiceTxt(char *name, char *proto){
420424
MDNSService* servicePtr;
421425
for (servicePtr = _services; servicePtr; servicePtr = servicePtr->_next) {
422426
if(servicePtr->_port > 0 && strcmp(servicePtr->_name, name) == 0 && strcmp(servicePtr->_proto, proto) == 0){
423-
if (servicePtr->_txts == 0) return false;
424-
else{
425-
return servicePtr->_txts;
426-
}
427+
if (servicePtr->_txts == 0)
428+
return false;
429+
return servicePtr->_txts;
427430
}
428431
}
429432
return 0;
@@ -433,10 +436,9 @@ uint16_t MDNSResponder::_getServiceTxtLen(char *name, char *proto){
433436
MDNSService* servicePtr;
434437
for (servicePtr = _services; servicePtr; servicePtr = servicePtr->_next) {
435438
if(servicePtr->_port > 0 && strcmp(servicePtr->_name, name) == 0 && strcmp(servicePtr->_proto, proto) == 0){
436-
if (servicePtr->_txts == 0) return false;
437-
else{
438-
return servicePtr->_txtLen;
439-
}
439+
if (servicePtr->_txts == 0)
440+
return false;
441+
return servicePtr->_txtLen;
440442
}
441443
}
442444
return 0;
@@ -487,7 +489,8 @@ void MDNSResponder::_parsePacket(){
487489

488490
uint16_t packetHeader[6];
489491

490-
for(i=0; i<6; i++) packetHeader[i] = _conn_read16();
492+
for(i=0; i<6; i++)
493+
packetHeader[i] = _conn_read16();
491494

492495
if ((packetHeader[1] & 0x8000) != 0) { // Read answers
493496
#ifdef DEBUG_ESP_MDNS_RX
@@ -644,6 +647,7 @@ void MDNSResponder::_parsePacket(){
644647
#endif
645648
tmp8 = _conn_read8();
646649
}
650+
647651
else {
648652
_conn_readS(answerHostName, tmp8);
649653
answerHostName[tmp8] = '\0';
@@ -671,7 +675,7 @@ void MDNSResponder::_parsePacket(){
671675
DEBUG_ESP_PORT.printf("Ignoring unsupported type %02x\n", tmp8);
672676
#endif
673677
for (int n = 0; n < answerRdlength; n++)
674-
(void)_conn_read8();
678+
(void)_conn_read8();
675679
}
676680

677681
if ((partsCollected == 0x0F) && serviceMatch) {
@@ -853,21 +857,33 @@ void MDNSResponder::_parsePacket(){
853857

854858
#ifdef DEBUG_ESP_MDNS_RX
855859
DEBUG_ESP_PORT.printf("REQ: ");
856-
if(hostNameLen > 0) DEBUG_ESP_PORT.printf("%s.", hostName);
857-
if(serviceNameLen > 0) DEBUG_ESP_PORT.printf("_%s.", serviceName);
858-
if(protoNameLen > 0) DEBUG_ESP_PORT.printf("_%s.", protoName);
860+
if(hostNameLen > 0)
861+
DEBUG_ESP_PORT.printf("%s.", hostName);
862+
if(serviceNameLen > 0)
863+
DEBUG_ESP_PORT.printf("_%s.", serviceName);
864+
if(protoNameLen > 0)
865+
DEBUG_ESP_PORT.printf("_%s.", protoName);
859866
DEBUG_ESP_PORT.printf("local. ");
860867

861-
if(currentType == MDNS_TYPE_AAAA) DEBUG_ESP_PORT.printf(" AAAA ");
862-
else if(currentType == MDNS_TYPE_A) DEBUG_ESP_PORT.printf(" A ");
863-
else if(currentType == MDNS_TYPE_PTR) DEBUG_ESP_PORT.printf(" PTR ");
864-
else if(currentType == MDNS_TYPE_SRV) DEBUG_ESP_PORT.printf(" SRV ");
865-
else if(currentType == MDNS_TYPE_TXT) DEBUG_ESP_PORT.printf(" TXT ");
866-
else DEBUG_ESP_PORT.printf(" 0x%04X ", currentType);
867-
868-
if(currentClass == MDNS_CLASS_IN) DEBUG_ESP_PORT.printf(" IN ");
869-
else if(currentClass == MDNS_CLASS_IN_FLUSH_CACHE) DEBUG_ESP_PORT.printf(" IN[F] ");
870-
else DEBUG_ESP_PORT.printf(" 0x%04X ", currentClass);
868+
if(currentType == MDNS_TYPE_AAAA)
869+
DEBUG_ESP_PORT.printf(" AAAA ");
870+
else if(currentType == MDNS_TYPE_A)
871+
DEBUG_ESP_PORT.printf(" A ");
872+
else if(currentType == MDNS_TYPE_PTR)
873+
DEBUG_ESP_PORT.printf(" PTR ");
874+
else if(currentType == MDNS_TYPE_SRV)
875+
DEBUG_ESP_PORT.printf(" SRV ");
876+
else if(currentType == MDNS_TYPE_TXT)
877+
DEBUG_ESP_PORT.printf(" TXT ");
878+
else
879+
DEBUG_ESP_PORT.printf(" 0x%04X ", currentType);
880+
881+
if(currentClass == MDNS_CLASS_IN)
882+
DEBUG_ESP_PORT.printf(" IN ");
883+
else if(currentClass == MDNS_CLASS_IN_FLUSH_CACHE)
884+
DEBUG_ESP_PORT.printf(" IN[F] ");
885+
else
886+
DEBUG_ESP_PORT.printf(" 0x%04X ", currentClass);
871887

872888
DEBUG_ESP_PORT.printf("\n");
873889
#endif
@@ -1035,8 +1051,10 @@ void MDNSResponder::_replyToInstanceRequest(uint8_t questionMask, uint8_t respon
10351051
uint8_t additionalMask = responseMask & ~questionMask;
10361052
uint8_t additionalCount = 0;
10371053
for(i=0;i<4;i++){
1038-
if(answerMask & (1 << i)) answerCount++;
1039-
if(additionalMask & (1 << i)) additionalCount++;
1054+
if(answerMask & (1 << i))
1055+
answerCount++;
1056+
if(additionalMask & (1 << i))
1057+
additionalCount++;
10401058
}
10411059

10421060

0 commit comments

Comments
 (0)