This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
The following commit(s) were added to refs/heads/master by this push:
new 54374b3b2 wireless/ieee802154/i8shark: validate received frame length
and offset
54374b3b2 is described below
commit 54374b3b2f48e1300df6cf9ea104805a0fc6c99f
Author: Swatantra Yadav <[email protected]>
AuthorDate: Sun Nov 1 00:30:12 2026 +0530
wireless/ieee802154/i8shark: validate received frame length and offset
i8shark copies frames from the MAC character driver into a fixed
159-byte stack buffer using frame.length and frame.offset without
validation. In promiscuous mode the driver does not clamp the length,
so a frame transmitted over the air could overflow zepframe, and the
XBEE_APPHDR and SUPPRESS_FCS variants could underflow their length
arithmetic.
- Drop frames with length < 2, length > IEEE802154_MAX_PHY_PACKET_SIZE
or offset > length.
- With XBEE_APPHDR, drop frames shorter than offset + 4 (app header
plus FCS are both stripped).
- With SUPPRESS_FCS, check the getfcslen() result and drop frames
shorter than the FCS to avoid uint8_t underflow.
- Check the final copy size against sizeof(zepframe).
- Zero zepframe so reserved ZEP header bytes do not leak stack contents.
- Parenthesize I8SHARK_MAX_ZEPFRAME.
Fixes #3950
Signed-off-by: Swatantra Yadav <[email protected]>
Assisted-by: Google Gemini
---
wireless/ieee802154/i8shark/i8shark_main.c | 46 ++++++++++++++++++++++++++----
1 file changed, 41 insertions(+), 5 deletions(-)
diff --git a/wireless/ieee802154/i8shark/i8shark_main.c
b/wireless/ieee802154/i8shark/i8shark_main.c
index c213045dc..6f0aeb3d7 100644
--- a/wireless/ieee802154/i8shark/i8shark_main.c
+++ b/wireless/ieee802154/i8shark/i8shark_main.c
@@ -75,7 +75,7 @@
#define I8SHARK_MAX_DEVPATH 15
#define ZEP_MAX_HDRSIZE 32
-#define I8SHARK_MAX_ZEPFRAME IEEE802154_MAX_PHY_PACKET_SIZE + ZEP_MAX_HDRSIZE
+#define I8SHARK_MAX_ZEPFRAME (IEEE802154_MAX_PHY_PACKET_SIZE + ZEP_MAX_HDRSIZE)
/****************************************************************************
* Private Types
@@ -238,6 +238,31 @@ static int i8shark_daemon(int argc, FAR char *argv[])
continue;
}
+ /* Validate frame length and offset to prevent out-of-bounds reads
+ * from frame.payload and buffer overflows when writing into zepframe.
+ * A valid 802.15.4 frame has at least a 2-byte Frame Control Field.
+ */
+
+ if (frame.length < 2 ||
+ frame.length > IEEE802154_MAX_PHY_PACKET_SIZE ||
+ frame.offset > frame.length)
+ {
+ continue;
+ }
+
+#ifdef CONFIG_IEEE802154_I8SHARK_XBEE_APPHDR
+ /* XBee app header (2 bytes) and FCS (2 bytes) are both stripped
+ * from the bytes following the MAC header.
+ */
+
+ if (frame.length < frame.offset + 4)
+ {
+ continue;
+ }
+#endif
+
+ memset(zepframe, 0, sizeof(zepframe));
+
/* First 2 bytes of packet represent preamble. For ZEP, "EX" */
zepframe[i++] = 'E';
@@ -353,13 +378,24 @@ static int i8shark_daemon(int argc, FAR char *argv[])
*/
#ifdef CONFIG_IEEE802154_I8SHARK_SUPPRESS_FCS
- {
- uint8_t fcslen;
- ieee802154_getfcslen(fd, &fcslen);
+ {
+ uint8_t fcslen = 0;
+
+ ret = ieee802154_getfcslen(fd, &fcslen);
+ if (ret < 0 || frame.length < fcslen)
+ {
+ continue;
+ }
+
frame.length -= fcslen;
- }
+ }
#endif
+ if ((size_t)(i + frame.length) > sizeof(zepframe))
+ {
+ continue;
+ }
+
memcpy(&zepframe[i], frame.payload, frame.length);
i += frame.length;
#endif
