ua1zbe
/
aprsc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added packet length checks in message parsing

This commit is contained in:
Heikki Hannikainen 2013-12-20 08:15:59 +02:00
parent 235dc293b9
commit 098ffd4362
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/parse_aprs.c
View File

@ -1052,7 +1052,7 @@ static int parse_aprs_3rdparty(struct pbuf_t *pb, const char *info_start)
* Parse APRS message slightly (only as much as is necessary for packet forwarding)
*/
static int preparse_aprs_message(struct pbuf_t *pb, const char *body, const char *body_end)
static int preparse_aprs_message(struct pbuf_t *pb, const char *body, int body_len)
{
// quick and loose way to identify NWS and SKYWARN messages
// they do apparently originate from "WXSRV", but that is not
@ -1065,11 +1065,11 @@ static int preparse_aprs_message(struct pbuf_t *pb, const char *body, const char
pb->packettype |= T_NWS;
// Is it perhaps TELEMETRY related "message" ?
if ( body[9] == ':' &&
if ( body[9] == ':' && body_len >= 10 + 6 &&
( memcmp( body+10, "PARM.", 5 ) == 0 ||
memcmp( body+10, "UNIT.", 5 ) == 0 ||
memcmp( body+10, "EQNS.", 5 ) == 0 ||
memcmp( body+10, "BITS.", 5 ) == 0 )) {
memcmp( body+10, "BITS.", 5 ) == 0 )) {
pb->packettype &= ~T_MESSAGE;
pb->packettype |= T_TELEMETRY;
// Fall through to recipient location lookup
@ -1200,8 +1200,11 @@ static int parse_aprs_body(struct pbuf_t *pb, const char *info_start)
return 0;
case ':':
pb->packettype |= T_MESSAGE;
return preparse_aprs_message(pb, body, body_end);
if (paclen >= 11) {
pb->packettype |= T_MESSAGE;
return preparse_aprs_message(pb, body, paclen-1);
}
return 0;
case ';':
if (body_end - body > 29)