anchao opened a new pull request, #20887:
URL: https://github.com/apache/nuttx/pull/20887

   ## Summary                                                                   
                                                                                
                                                                                
                                                                        
                                                                                
                                                                                
                                                                                
                                                                        
   Fix HC06 6LoWPAN header decompression so UDP NHC reconstruction is only 
handled when `CONFIG_NET_UDP` is enabled.                                       
                                                                                
                                                                             
                                                                                
                                                                                
                                                                                
                                                                        
   ## Problem                                                                   
                                                                                
                                                                                
                                                                        
                                                                                
                                                                                
                                                                                
                                                                        
   The HC06 decompressor accepted `LOWPAN_NHC_UDP` even when UDP support was 
disabled. For subsequent fragments, `sixlowpan_input()` decompresses headers 
into `g_bitbucket`, whose size depends on the enabled transport protocols. In 
non-UDP builds, reconstructing a UDP header can write past that scratch buffer. 
                                                                                
                                                                                
                                                                                
                                                                        
   ## Solution                                                                  
                                                                                
                                                                                
                                                                        
                                                                                
                                                                                
                                                                                
                                                                        
   This patch:                                                                  
                                                                                
                                                                                
                                                                        
                                                                                
                                                                                
                                                                                
                                                                        
   - keeps UDP NHC handling behind `CONFIG_NET_UDP`                             
                                                                                
                                                                                
                                                                        
   - rejects compressed next headers when UDP support is disabled               
                                                                                
                                                                                
                                                                        
   - rejects unsupported NHC types instead of continuing silently               
                                                                                
                                                                                
                                                                        
   - validates the inline NHC byte before reading it                            
                                                                                
                                                                                
                                                                        
   - validates inline UDP checksum bytes before copying them                    
                                                                                
                                                                                
                                                                        
   - keeps UDP length reconstruction behind `CONFIG_NET_UDP`                    
                                                                                
                                                                                
                                                                        
                                                                                
                                                                                
                                                                                
                                                                        
   ## Testing                                                                   
                                                                                
                                                                                
                                                                        
   
   sim/sixlowpan


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to