Hex parsing hardening.

This commit is contained in:
Ian Gulliver
2016-02-26 14:09:37 -08:00
parent e89d30af24
commit e3a372e1ea
11 changed files with 55 additions and 21 deletions

View File

@@ -53,7 +53,11 @@ static bool airspy_adsb_parse_common(const struct airspy_adsb_common_overlay *ov
if (!mlat_mhz) {
return false;
}
packet->mlat_timestamp = packet_mlat_timestamp_scale_in(hex_to_int(overlay->mlat_timestamp, sizeof(overlay->mlat_timestamp) / 2), UINT32_MAX, mlat_mhz, &state->mlat_state);
int64_t mlat_timestamp_in = hex_to_int(overlay->mlat_timestamp, sizeof(overlay->mlat_timestamp) / 2);
if (mlat_timestamp_in < 0) {
return false;
}
packet->mlat_timestamp = packet_mlat_timestamp_scale_in((uint64_t) mlat_timestamp_in, UINT32_MAX, mlat_mhz, &state->mlat_state);
packet->rssi = packet_rssi_scale_in((uint32_t) hex_to_int(overlay->rssi, sizeof(overlay->rssi) / 2), UINT16_MAX);
return true;
}
@@ -71,7 +75,9 @@ static bool airspy_adsb_parse_mode_s_short(struct buf *buf, struct packet *packe
return false;
}
packet->type = PACKET_TYPE_MODE_S_SHORT;
hex_to_bin(packet->payload, short_overlay->payload, sizeof(short_overlay->payload) / 2);
if (!hex_to_bin(packet->payload, short_overlay->payload, sizeof(short_overlay->payload) / 2)) {
return false;
}
buf_consume(buf, sizeof(*short_overlay));
return true;
}
@@ -89,7 +95,9 @@ static bool airspy_adsb_parse_mode_s_long(struct buf *buf, struct packet *packet
return false;
}
packet->type = PACKET_TYPE_MODE_S_LONG;
hex_to_bin(packet->payload, long_overlay->payload, sizeof(long_overlay->payload) / 2);
if (!hex_to_bin(packet->payload, long_overlay->payload, sizeof(long_overlay->payload) / 2)) {
return false;
}
buf_consume(buf, sizeof(*long_overlay));
return true;
}

View File

@@ -6,5 +6,5 @@ struct buf;
struct packet;
void airspy_adsb_init(void);
bool airspy_adsb_parse(struct buf *, struct packet *, void *);
bool __attribute__ ((warn_unused_result)) airspy_adsb_parse(struct buf *, struct packet *, void *);
void airspy_adsb_serialize(struct packet *, struct buf *);

View File

@@ -6,5 +6,5 @@ struct buf;
struct packet;
void beast_init(void);
bool beast_parse(struct buf *, struct packet *, void *);
bool __attribute__ ((warn_unused_result)) beast_parse(struct buf *, struct packet *, void *);
void beast_serialize(struct packet *, struct buf *);

View File

@@ -4,11 +4,16 @@
#include "hex.h"
static uint8_t hex_table[256] = {0};
static uint8_t hex_table[256];
static uint8_t hex_upper_table[16] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F', };
static uint8_t hex_lower_table[16] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', };
#define HEX_INVALID 0xff
void hex_init() {
for (size_t i = 0; i < sizeof(hex_table) / sizeof(*hex_table); i++) {
hex_table[i] = HEX_INVALID;
}
for (uint8_t i = '0'; i <= '9'; i++) {
hex_table[i] = i - '0';
}
@@ -20,21 +25,33 @@ void hex_init() {
}
}
void hex_to_bin(uint8_t *out, const uint8_t *in, size_t bytes) {
bool hex_to_bin(uint8_t *out, const uint8_t *in, size_t bytes) {
for (size_t i = 0, j = 0; i < bytes; i++, j += 2) {
out[i] = (uint8_t) (hex_table[in[j]] << 4) | hex_table[in[j + 1]];
uint8_t val1 = hex_table[in[j]], val2 = hex_table[in[j + 1]];
if (val1 == HEX_INVALID || val2 == HEX_INVALID) {
return false;
}
out[i] = (uint8_t) (val1 << 4) | val2;
}
return true;
}
uint64_t hex_to_int(const uint8_t *in, size_t bytes) {
int64_t hex_to_int(const uint8_t *in, size_t bytes) {
const uint8_t *in2 = (const uint8_t *) in;
uint64_t ret = 0;
bytes *= 2;
for (size_t i = 0; i < bytes; i++) {
ret <<= 4;
ret |= hex_table[in2[i]];
uint8_t val = hex_table[in2[i]];
if (val == 0xff) {
return -1;
}
return ret;
ret |= val;
}
if (ret > INT64_MAX) {
return -1;
}
return (int64_t) ret;
}
static void hex_from_bin(uint8_t *out, const uint8_t *in, size_t bytes, uint8_t table[]) {

View File

@@ -1,11 +1,12 @@
#pragma once
#include <stdint.h>
#include <stdbool.h>
#include <stddef.h>
void hex_init(void);
void hex_to_bin(uint8_t *, const uint8_t *, size_t);
uint64_t hex_to_int(const uint8_t *, size_t);
bool __attribute__ ((warn_unused_result)) hex_to_bin(uint8_t *, const uint8_t *, size_t);
int64_t __attribute__ ((warn_unused_result)) hex_to_int(const uint8_t *, size_t);
void hex_from_bin_upper(uint8_t *, const uint8_t *, size_t);
void hex_from_bin_lower(uint8_t *, const uint8_t *, size_t);
void hex_from_int_upper(uint8_t *, uint64_t, size_t);

View File

@@ -157,7 +157,9 @@ static bool json_parse_mode_s_short(json_t *in, struct packet *packet, struct js
return false;
}
hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 7);
if (!hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 7)) {
return false;
}
packet->type = PACKET_TYPE_MODE_S_SHORT;
return true;
}
@@ -172,7 +174,9 @@ static bool json_parse_mode_s_long(json_t *in, struct packet *packet, struct jso
return false;
}
hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 14);
if (!hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 14)) {
return false;
}
packet->type = PACKET_TYPE_MODE_S_LONG;
return true;
}

View File

@@ -7,7 +7,7 @@ struct packet;
void json_init(void);
void json_cleanup(void);
bool json_parse(struct buf *, struct packet *, void *);
bool __attribute__ ((warn_unused_result)) json_parse(struct buf *, struct packet *, void *);
void json_serialize(struct packet *, struct buf *);
int json_buf_append_callback(const char *, size_t, void *);

View File

@@ -34,6 +34,6 @@ struct list_head {
pos = n, n = list_entry(n->member.next, typeof(*n), member))
void list_head_init(struct list_head *);
bool list_is_empty(const struct list_head *);
bool __attribute__ ((warn_unused_result)) list_is_empty(const struct list_head *);
void list_add(struct list_head *, struct list_head *);
void list_del(struct list_head *);

View File

@@ -6,5 +6,5 @@ struct buf;
struct packet;
void proto_cleanup(void);
bool proto_parse(struct buf *, struct packet *, void *);
bool __attribute__ ((warn_unused_result)) proto_parse(struct buf *, struct packet *, void *);
void proto_serialize(struct packet *, struct buf *);

View File

@@ -34,8 +34,10 @@ static bool raw_parse_mode_s_short(struct buf *buf, struct packet *packet) {
(overlay->cr_lf != '\r' || overlay->lf != '\n'))) {
return false;
}
if (!hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2)) {
return false;
}
packet->type = PACKET_TYPE_MODE_S_SHORT;
hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2);
buf_consume(buf, overlay->cr_lf == '\r' ? sizeof(*overlay) : sizeof(*overlay) - 1);
return true;
}
@@ -49,8 +51,10 @@ static bool raw_parse_mode_s_long(struct buf *buf, struct packet *packet) {
(overlay->cr_lf != '\r' || overlay->lf != '\n'))) {
return false;
}
if (!hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2)) {
return false;
}
packet->type = PACKET_TYPE_MODE_S_LONG;
hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2);
buf_consume(buf, overlay->cr_lf == '\r' ? sizeof(*overlay) : sizeof(*overlay) - 1);
return true;
}

View File

@@ -6,5 +6,5 @@ struct buf;
struct packet;
void raw_init(void);
bool raw_parse(struct buf *, struct packet *, void *);
bool __attribute__ ((warn_unused_result)) raw_parse(struct buf *, struct packet *, void *);
void raw_serialize(struct packet *, struct buf *);