Swatantra-66 opened a new pull request, #3951: URL: https://github.com/apache/nuttx-apps/pull/3951
## Summary Fixes a radio-triggered stack buffer overflow and integer underflows in `i8shark` when receiving IEEE 802.15.4 frames (#3950). In promiscuous mode, the MAC character driver reports `rx->length = io_len + fcslen` without clamping to `IEEE802154_MAX_PHY_PACKET_SIZE` (127). Sizing `memcpy(&zepframe[i], ...)` with `i = 32` into the exact-sized `zepframe[159]` stack buffer allows frames up to 129 bytes to write past `zepframe[158]`. Furthermore, `CONFIG_IEEE802154_I8SHARK_XBEE_APPHDR` had a signed underflow (`frame.length - frame.offset - 2`), and `CONFIG_IEEE802154_I8SHARK_SUPPRESS_FCS` had an unsigned underflow when `frame.length < fcslen`. Key changes: 1. Immediately validate `frame.length >= 2`, `frame.length <= IEEE802154_MAX_PHY_PACKET_SIZE`, and `frame.offset <= frame.length`. 2. In `CONFIG_IEEE802154_I8SHARK_XBEE_APPHDR`, drop frames where `frame.length < frame.offset + 4` (since 2-byte app header + 2-byte FCS are stripped). In XBEE mode, frames too short to contain the app header plus FCS (e.g. ACKs) are now dropped instead of being forwarded as malformed packets. 3. In `CONFIG_IEEE802154_I8SHARK_SUPPRESS_FCS`, check `ieee802154_getfcslen()` return value and drop frames where `frame.length < fcslen` to prevent `uint8_t` underflow. 4. Add secondary check `(size_t)(i + frame.length) > sizeof(zepframe)` before `memcpy`. 5. Zero `zepframe` so 10 reserved ZEP header bytes do not leak uninitialized stack memory over UDP. 6. Parenthesize `#define I8SHARK_MAX_ZEPFRAME (IEEE802154_MAX_PHY_PACKET_SIZE + ZEP_MAX_HDRSIZE)`. Note: Frames with length 128 or 129 bytes are discarded by this userspace clamp to prevent buffer overflow. Clamping in the kernel MAC character driver is out of scope and can be addressed separately in `nuttx`. ## Impact - Prevents stack buffer overflow and crashes in `i8shark` from malformed or maximal radio frames. - Prevents leaking stack data over UDP in reserved ZEP header fields. ## Testing - Verified with `checkpatch.sh -m -g` and `nxstyle` (0 errors, 0 warnings). - Validated code paths across default, `CONFIG_IEEE802154_I8SHARK_XBEE_APPHDR`, and `CONFIG_IEEE802154_I8SHARK_SUPPRESS_FCS` configurations. Fixes #3950 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
