kevin/meshtastic_firmware
1
0
Fork 0
Code Issues Pull Requests Actions 7 Packages Projects Releases Wiki Activity

mesh: bound the user-facing notification sprintf calls (#10437)

Browse Source 
Two sites built ClientNotification messages with sprintf into a
fixed-size proto buffer with no length cap. The current format strings
fit comfortably, but a future caller editing either format string
without rechecking the buffer size would get a silent stack/heap
overrun. Switch to snprintf with sizeof so the bound is enforced at
the call site.

Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
This commit is contained in:
Sylwester
2026-05-09 13:32:42 -05:00
committed by GitHub
co-authored by GitHub Ben Meadors
parent fefd424901
commit 1bcabb893b
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mesh/NodeDB.cpp
+1 -1
View File
@@ -1881,7 +1881,7 @@ bool NodeDB::updateUser(uint32_t nodeId, meshtastic_User &p, uint8_t channelInde
meshtastic_ClientNotification *cn = clientNotificationPool.allocZeroed(); meshtastic_ClientNotification *cn = clientNotificationPool.allocZeroed();
cn->level = meshtastic_LogRecord_Level_WARNING; cn->level = meshtastic_LogRecord_Level_WARNING;
cn->time = getValidTime(RTCQualityFromNet); cn->time = getValidTime(RTCQualityFromNet);
sprintf(cn->message, warning, p.long_name); snprintf(cn->message, sizeof(cn->message), warning, p.long_name);
service->sendClientNotification(cn); service->sendClientNotification(cn);
} }
return false; return false;
src/mesh/Router.cpp
+1 -1
View File
@@ -329,7 +329,7 @@ ErrorCode Router::send(meshtastic_MeshPacket *p)
cn->reply_id = p->id; cn->reply_id = p->id;
cn->level = meshtastic_LogRecord_Level_WARNING; cn->level = meshtastic_LogRecord_Level_WARNING;
cn->time = getValidTime(RTCQualityFromNet); cn->time = getValidTime(RTCQualityFromNet);
sprintf(cn->message, "Duty cycle limit exceeded. You can send again in %d mins", silentMinutes); snprintf(cn->message, sizeof(cn->message), "Duty cycle limit exceeded. You can send again in %d mins", silentMinutes);
service->sendClientNotification(cn); service->sendClientNotification(cn);
meshtastic_Routing_Error err = meshtastic_Routing_Error_DUTY_CYCLE_LIMIT; meshtastic_Routing_Error err = meshtastic_Routing_Error_DUTY_CYCLE_LIMIT;