Hex parsing hardening.
This commit is contained in:
@@ -53,7 +53,11 @@ static bool airspy_adsb_parse_common(const struct airspy_adsb_common_overlay *ov
|
||||
if (!mlat_mhz) {
|
||||
return false;
|
||||
}
|
||||
packet->mlat_timestamp = packet_mlat_timestamp_scale_in(hex_to_int(overlay->mlat_timestamp, sizeof(overlay->mlat_timestamp) / 2), UINT32_MAX, mlat_mhz, &state->mlat_state);
|
||||
int64_t mlat_timestamp_in = hex_to_int(overlay->mlat_timestamp, sizeof(overlay->mlat_timestamp) / 2);
|
||||
if (mlat_timestamp_in < 0) {
|
||||
return false;
|
||||
}
|
||||
packet->mlat_timestamp = packet_mlat_timestamp_scale_in((uint64_t) mlat_timestamp_in, UINT32_MAX, mlat_mhz, &state->mlat_state);
|
||||
packet->rssi = packet_rssi_scale_in((uint32_t) hex_to_int(overlay->rssi, sizeof(overlay->rssi) / 2), UINT16_MAX);
|
||||
return true;
|
||||
}
|
||||
@@ -71,7 +75,9 @@ static bool airspy_adsb_parse_mode_s_short(struct buf *buf, struct packet *packe
|
||||
return false;
|
||||
}
|
||||
packet->type = PACKET_TYPE_MODE_S_SHORT;
|
||||
hex_to_bin(packet->payload, short_overlay->payload, sizeof(short_overlay->payload) / 2);
|
||||
if (!hex_to_bin(packet->payload, short_overlay->payload, sizeof(short_overlay->payload) / 2)) {
|
||||
return false;
|
||||
}
|
||||
buf_consume(buf, sizeof(*short_overlay));
|
||||
return true;
|
||||
}
|
||||
@@ -89,7 +95,9 @@ static bool airspy_adsb_parse_mode_s_long(struct buf *buf, struct packet *packet
|
||||
return false;
|
||||
}
|
||||
packet->type = PACKET_TYPE_MODE_S_LONG;
|
||||
hex_to_bin(packet->payload, long_overlay->payload, sizeof(long_overlay->payload) / 2);
|
||||
if (!hex_to_bin(packet->payload, long_overlay->payload, sizeof(long_overlay->payload) / 2)) {
|
||||
return false;
|
||||
}
|
||||
buf_consume(buf, sizeof(*long_overlay));
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -6,5 +6,5 @@ struct buf;
|
||||
struct packet;
|
||||
|
||||
void airspy_adsb_init(void);
|
||||
bool airspy_adsb_parse(struct buf *, struct packet *, void *);
|
||||
bool __attribute__ ((warn_unused_result)) airspy_adsb_parse(struct buf *, struct packet *, void *);
|
||||
void airspy_adsb_serialize(struct packet *, struct buf *);
|
||||
|
||||
@@ -6,5 +6,5 @@ struct buf;
|
||||
struct packet;
|
||||
|
||||
void beast_init(void);
|
||||
bool beast_parse(struct buf *, struct packet *, void *);
|
||||
bool __attribute__ ((warn_unused_result)) beast_parse(struct buf *, struct packet *, void *);
|
||||
void beast_serialize(struct packet *, struct buf *);
|
||||
|
||||
29
adsbus/hex.c
29
adsbus/hex.c
@@ -4,11 +4,16 @@
|
||||
|
||||
#include "hex.h"
|
||||
|
||||
static uint8_t hex_table[256] = {0};
|
||||
static uint8_t hex_table[256];
|
||||
static uint8_t hex_upper_table[16] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F', };
|
||||
static uint8_t hex_lower_table[16] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', };
|
||||
|
||||
#define HEX_INVALID 0xff
|
||||
|
||||
void hex_init() {
|
||||
for (size_t i = 0; i < sizeof(hex_table) / sizeof(*hex_table); i++) {
|
||||
hex_table[i] = HEX_INVALID;
|
||||
}
|
||||
for (uint8_t i = '0'; i <= '9'; i++) {
|
||||
hex_table[i] = i - '0';
|
||||
}
|
||||
@@ -20,21 +25,33 @@ void hex_init() {
|
||||
}
|
||||
}
|
||||
|
||||
void hex_to_bin(uint8_t *out, const uint8_t *in, size_t bytes) {
|
||||
bool hex_to_bin(uint8_t *out, const uint8_t *in, size_t bytes) {
|
||||
for (size_t i = 0, j = 0; i < bytes; i++, j += 2) {
|
||||
out[i] = (uint8_t) (hex_table[in[j]] << 4) | hex_table[in[j + 1]];
|
||||
uint8_t val1 = hex_table[in[j]], val2 = hex_table[in[j + 1]];
|
||||
if (val1 == HEX_INVALID || val2 == HEX_INVALID) {
|
||||
return false;
|
||||
}
|
||||
out[i] = (uint8_t) (val1 << 4) | val2;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
uint64_t hex_to_int(const uint8_t *in, size_t bytes) {
|
||||
int64_t hex_to_int(const uint8_t *in, size_t bytes) {
|
||||
const uint8_t *in2 = (const uint8_t *) in;
|
||||
uint64_t ret = 0;
|
||||
bytes *= 2;
|
||||
for (size_t i = 0; i < bytes; i++) {
|
||||
ret <<= 4;
|
||||
ret |= hex_table[in2[i]];
|
||||
uint8_t val = hex_table[in2[i]];
|
||||
if (val == 0xff) {
|
||||
return -1;
|
||||
}
|
||||
ret |= val;
|
||||
}
|
||||
return ret;
|
||||
if (ret > INT64_MAX) {
|
||||
return -1;
|
||||
}
|
||||
return (int64_t) ret;
|
||||
}
|
||||
|
||||
static void hex_from_bin(uint8_t *out, const uint8_t *in, size_t bytes, uint8_t table[]) {
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
#pragma once
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
#include <stddef.h>
|
||||
|
||||
void hex_init(void);
|
||||
void hex_to_bin(uint8_t *, const uint8_t *, size_t);
|
||||
uint64_t hex_to_int(const uint8_t *, size_t);
|
||||
bool __attribute__ ((warn_unused_result)) hex_to_bin(uint8_t *, const uint8_t *, size_t);
|
||||
int64_t __attribute__ ((warn_unused_result)) hex_to_int(const uint8_t *, size_t);
|
||||
void hex_from_bin_upper(uint8_t *, const uint8_t *, size_t);
|
||||
void hex_from_bin_lower(uint8_t *, const uint8_t *, size_t);
|
||||
void hex_from_int_upper(uint8_t *, uint64_t, size_t);
|
||||
|
||||
@@ -157,7 +157,9 @@ static bool json_parse_mode_s_short(json_t *in, struct packet *packet, struct js
|
||||
return false;
|
||||
}
|
||||
|
||||
hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 7);
|
||||
if (!hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 7)) {
|
||||
return false;
|
||||
}
|
||||
packet->type = PACKET_TYPE_MODE_S_SHORT;
|
||||
return true;
|
||||
}
|
||||
@@ -172,7 +174,9 @@ static bool json_parse_mode_s_long(json_t *in, struct packet *packet, struct jso
|
||||
return false;
|
||||
}
|
||||
|
||||
hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 14);
|
||||
if (!hex_to_bin(packet->payload, (const uint8_t *) json_string_value(payload), 14)) {
|
||||
return false;
|
||||
}
|
||||
packet->type = PACKET_TYPE_MODE_S_LONG;
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -7,7 +7,7 @@ struct packet;
|
||||
|
||||
void json_init(void);
|
||||
void json_cleanup(void);
|
||||
bool json_parse(struct buf *, struct packet *, void *);
|
||||
bool __attribute__ ((warn_unused_result)) json_parse(struct buf *, struct packet *, void *);
|
||||
void json_serialize(struct packet *, struct buf *);
|
||||
|
||||
int json_buf_append_callback(const char *, size_t, void *);
|
||||
|
||||
@@ -34,6 +34,6 @@ struct list_head {
|
||||
pos = n, n = list_entry(n->member.next, typeof(*n), member))
|
||||
|
||||
void list_head_init(struct list_head *);
|
||||
bool list_is_empty(const struct list_head *);
|
||||
bool __attribute__ ((warn_unused_result)) list_is_empty(const struct list_head *);
|
||||
void list_add(struct list_head *, struct list_head *);
|
||||
void list_del(struct list_head *);
|
||||
|
||||
@@ -6,5 +6,5 @@ struct buf;
|
||||
struct packet;
|
||||
|
||||
void proto_cleanup(void);
|
||||
bool proto_parse(struct buf *, struct packet *, void *);
|
||||
bool __attribute__ ((warn_unused_result)) proto_parse(struct buf *, struct packet *, void *);
|
||||
void proto_serialize(struct packet *, struct buf *);
|
||||
|
||||
@@ -34,8 +34,10 @@ static bool raw_parse_mode_s_short(struct buf *buf, struct packet *packet) {
|
||||
(overlay->cr_lf != '\r' || overlay->lf != '\n'))) {
|
||||
return false;
|
||||
}
|
||||
if (!hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2)) {
|
||||
return false;
|
||||
}
|
||||
packet->type = PACKET_TYPE_MODE_S_SHORT;
|
||||
hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2);
|
||||
buf_consume(buf, overlay->cr_lf == '\r' ? sizeof(*overlay) : sizeof(*overlay) - 1);
|
||||
return true;
|
||||
}
|
||||
@@ -49,8 +51,10 @@ static bool raw_parse_mode_s_long(struct buf *buf, struct packet *packet) {
|
||||
(overlay->cr_lf != '\r' || overlay->lf != '\n'))) {
|
||||
return false;
|
||||
}
|
||||
if (!hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2)) {
|
||||
return false;
|
||||
}
|
||||
packet->type = PACKET_TYPE_MODE_S_LONG;
|
||||
hex_to_bin(packet->payload, overlay->payload, sizeof(overlay->payload) / 2);
|
||||
buf_consume(buf, overlay->cr_lf == '\r' ? sizeof(*overlay) : sizeof(*overlay) - 1);
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -6,5 +6,5 @@ struct buf;
|
||||
struct packet;
|
||||
|
||||
void raw_init(void);
|
||||
bool raw_parse(struct buf *, struct packet *, void *);
|
||||
bool __attribute__ ((warn_unused_result)) raw_parse(struct buf *, struct packet *, void *);
|
||||
void raw_serialize(struct packet *, struct buf *);
|
||||
|
||||
Reference in New Issue
Block a user