diff --git a/examples/simple_repeater/MyMesh.cpp b/examples/simple_repeater/MyMesh.cpp index 81c1dcb42..5a809e24f 100644 --- a/examples/simple_repeater/MyMesh.cpp +++ b/examples/simple_repeater/MyMesh.cpp @@ -151,6 +151,7 @@ uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t send reply_path_hash_size = (*data >> 6) + 1; data++; + if (reply_path_len * reply_path_hash_size > MAX_PATH_SIZE) return 0; memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size); // data += (uint8_t)reply_path_len * reply_path_hash_size; @@ -170,6 +171,7 @@ uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender reply_path_hash_size = (*data >> 6) + 1; data++; + if (reply_path_len * reply_path_hash_size > MAX_PATH_SIZE) return 0; memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size); // data += (uint8_t)reply_path_len * reply_path_hash_size; @@ -190,6 +192,7 @@ uint8_t MyMesh::handleAnonClockReq(const mesh::Identity& sender, uint32_t sender reply_path_hash_size = (*data >> 6) + 1; data++; + if (reply_path_len * reply_path_hash_size > MAX_PATH_SIZE) return 0; memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size); // data += (uint8_t)reply_path_len * reply_path_hash_size; diff --git a/src/Packet.cpp b/src/Packet.cpp index aad3e2f48..180e6eabb 100644 --- a/src/Packet.cpp +++ b/src/Packet.cpp @@ -22,7 +22,7 @@ size_t Packet::writePath(uint8_t* dest, const uint8_t* src, uint8_t path_len) { uint8_t hash_size = (path_len >> 6) + 1; size_t len = hash_count*hash_size; if (len > MAX_PATH_SIZE) { - MESH_DEBUG_PRINTLN("Packet::copyPath, invalid path_len=%d", (uint32_t)path_len); + MESH_DEBUG_PRINTLN("Packet::writePath, invalid path_len=%d", (uint32_t)path_len); return 0; // Error } memcpy(dest, src, len); @@ -30,7 +30,9 @@ size_t Packet::writePath(uint8_t* dest, const uint8_t* src, uint8_t path_len) { } uint8_t Packet::copyPath(uint8_t* dest, const uint8_t* src, uint8_t path_len) { - writePath(dest, src, path_len); + if (writePath(dest, src, path_len) == 0 && (path_len & 63) != 0) { + return 0; // Error: writePath failed for non-empty path + } return path_len; }