From 0d2a9b6282c9f2ddd792696a6575be3fe12935dd Mon Sep 17 00:00:00 2001 From: Ben Meadors Date: Tue, 23 Jul 2024 06:16:53 -0500 Subject: [PATCH] Fix de/compression buffer overflows in TAK packets (#4317) * Fix de/compression buffer overflows in TAK packets * Log message --- .semgrepignore | 2 +- .../compression/{unishox2.c => unishox2.cpp} | 19 +++- src/mesh/compression/unishox2.h | 76 ++++---------- src/modules/AtakPluginModule.cpp | 99 +++++++++++++------ src/modules/PositionModule.cpp | 8 +- 5 files changed, 108 insertions(+), 96 deletions(-) rename src/mesh/compression/{unishox2.c => unishox2.cpp} (98%) diff --git a/.semgrepignore b/.semgrepignore index 10fcb5f75..b4267ad23 100644 --- a/.semgrepignore +++ b/.semgrepignore @@ -1,2 +1,2 @@ .github/workflows/main_matrix.yml -src/mesh/compression/unishox2.c +src/mesh/compression/unishox2.cpp diff --git a/src/mesh/compression/unishox2.c b/src/mesh/compression/unishox2.cpp similarity index 98% rename from src/mesh/compression/unishox2.c rename to src/mesh/compression/unishox2.cpp index 99c62f659..fcb12a222 100644 --- a/src/mesh/compression/unishox2.c +++ b/src/mesh/compression/unishox2.cpp @@ -15,6 +15,7 @@ * * @author Arundale Ramanathan * + * Port for Particle (particle.io) / Aruino - Jonathan Greenblatt */ /** * @file unishox2.c @@ -36,6 +37,14 @@ /// uint8_t is unsigned char typedef unsigned char uint8_t; +const char *USX_FREQ_SEQ_DFLT[] = {"\": \"", "\": ", ""}; +const char *USX_FREQ_SEQ_XML[] = {"", "" \ - } -/// Frequently occurring sequences in XML content -#define USX_FREQ_SEQ_XML \ - (const char *[]) \ - { \ - "", "has_contact) { - auto length = unishox2_compress_simple(t->contact.callsign, strlen(t->contact.callsign), compressed.contact.callsign); + auto length = unishox2_compress_lines(t->contact.callsign, strlen(t->contact.callsign), compressed.contact.callsign, + sizeof(compressed.contact.callsign) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Compression overflowed contact.callsign. Reverting to uncompressed packet\n"); + return; + } LOG_DEBUG("Compressed callsign: %d bytes\n", length); - - length = unishox2_compress_simple(t->contact.device_callsign, strlen(t->contact.device_callsign), - compressed.contact.device_callsign); + length = unishox2_compress_lines(t->contact.device_callsign, strlen(t->contact.device_callsign), + compressed.contact.device_callsign, sizeof(compressed.contact.device_callsign) - 1, + USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Compression overflowed contact.device_callsign. Reverting to uncompressed packet\n"); + return; + } LOG_DEBUG("Compressed device_callsign: %d bytes\n", length); } if (t->which_payload_variant == meshtastic_TAKPacket_chat_tag) { - auto length = unishox2_compress_simple(t->payload_variant.chat.message, strlen(t->payload_variant.chat.message), - compressed.payload_variant.chat.message); + auto length = unishox2_compress_lines(t->payload_variant.chat.message, strlen(t->payload_variant.chat.message), + compressed.payload_variant.chat.message, + sizeof(compressed.payload_variant.chat.message) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Compression overflowed chat.message. Reverting to uncompressed packet\n"); + return; + } LOG_DEBUG("Compressed chat message: %d bytes\n", length); if (t->payload_variant.chat.has_to) { compressed.payload_variant.chat.has_to = true; - length = unishox2_compress_simple(t->payload_variant.chat.to, strlen(t->payload_variant.chat.to), - compressed.payload_variant.chat.to); + length = unishox2_compress_lines(t->payload_variant.chat.to, strlen(t->payload_variant.chat.to), + compressed.payload_variant.chat.to, + sizeof(compressed.payload_variant.chat.to) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Compression overflowed chat.to. Reverting to uncompressed packet\n"); + return; + } LOG_DEBUG("Compressed chat to: %d bytes\n", length); } if (t->payload_variant.chat.has_to_callsign) { compressed.payload_variant.chat.has_to_callsign = true; - length = - unishox2_compress_simple(t->payload_variant.chat.to_callsign, strlen(t->payload_variant.chat.to_callsign), - compressed.payload_variant.chat.to_callsign); + length = unishox2_compress_lines(t->payload_variant.chat.to_callsign, strlen(t->payload_variant.chat.to_callsign), + compressed.payload_variant.chat.to_callsign, + sizeof(compressed.payload_variant.chat.to_callsign) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Compression overflowed chat.to_callsign. Reverting to uncompressed packet\n"); + return; + } LOG_DEBUG("Compressed chat to_callsign: %d bytes\n", length); } } @@ -102,7 +122,7 @@ void AtakPluginModule::alterReceivedProtobuf(meshtastic_MeshPacket &mp, meshtast } else { if (!t->is_compressed) { // Not compressed. Something is wrong - LOG_ERROR("Received uncompressed TAKPacket over radio!\n"); + LOG_WARN("Received uncompressed TAKPacket over radio! Skipping\n"); return; } @@ -112,32 +132,55 @@ void AtakPluginModule::alterReceivedProtobuf(meshtastic_MeshPacket &mp, meshtast uncompressed.is_compressed = false; if (t->has_contact) { auto length = - unishox2_decompress_simple(t->contact.callsign, strlen(t->contact.callsign), uncompressed.contact.callsign); - + unishox2_decompress_lines(t->contact.callsign, strlen(t->contact.callsign), uncompressed.contact.callsign, + sizeof(uncompressed.contact.callsign) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Decompression overflowed contact.callsign. Bailing out\n"); + return; + } LOG_DEBUG("Decompressed callsign: %d bytes\n", length); - length = unishox2_decompress_simple(t->contact.device_callsign, strlen(t->contact.device_callsign), - uncompressed.contact.device_callsign); - + length = unishox2_decompress_lines(t->contact.device_callsign, strlen(t->contact.device_callsign), + uncompressed.contact.device_callsign, + sizeof(uncompressed.contact.device_callsign) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Decompression overflowed contact.device_callsign. Bailing out\n"); + return; + } LOG_DEBUG("Decompressed device_callsign: %d bytes\n", length); } if (uncompressed.which_payload_variant == meshtastic_TAKPacket_chat_tag) { - auto length = unishox2_decompress_simple(t->payload_variant.chat.message, strlen(t->payload_variant.chat.message), - uncompressed.payload_variant.chat.message); + auto length = unishox2_decompress_lines(t->payload_variant.chat.message, strlen(t->payload_variant.chat.message), + uncompressed.payload_variant.chat.message, + sizeof(uncompressed.payload_variant.chat.message) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Decompression overflowed chat.message. Bailing out\n"); + return; + } LOG_DEBUG("Decompressed chat message: %d bytes\n", length); if (t->payload_variant.chat.has_to) { uncompressed.payload_variant.chat.has_to = true; - length = unishox2_decompress_simple(t->payload_variant.chat.to, strlen(t->payload_variant.chat.to), - uncompressed.payload_variant.chat.to); + length = unishox2_decompress_lines(t->payload_variant.chat.to, strlen(t->payload_variant.chat.to), + uncompressed.payload_variant.chat.to, + sizeof(uncompressed.payload_variant.chat.to) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Decompression overflowed chat.to. Bailing out\n"); + return; + } LOG_DEBUG("Decompressed chat to: %d bytes\n", length); } if (t->payload_variant.chat.has_to_callsign) { uncompressed.payload_variant.chat.has_to_callsign = true; length = - unishox2_decompress_simple(t->payload_variant.chat.to_callsign, strlen(t->payload_variant.chat.to_callsign), - uncompressed.payload_variant.chat.to_callsign); + unishox2_decompress_lines(t->payload_variant.chat.to_callsign, strlen(t->payload_variant.chat.to_callsign), + uncompressed.payload_variant.chat.to_callsign, + sizeof(uncompressed.payload_variant.chat.to_callsign) - 1, USX_PSET_DFLT, NULL); + if (length < 0) { + LOG_WARN("Decompression overflowed chat.to_callsign. Bailing out\n"); + return; + } LOG_DEBUG("Decompressed chat to_callsign: %d bytes\n", length); } } @@ -148,4 +191,4 @@ void AtakPluginModule::alterReceivedProtobuf(meshtastic_MeshPacket &mp, meshtast service.sendToPhone(decompressedCopy); } return; -} \ No newline at end of file +} diff --git a/src/modules/PositionModule.cpp b/src/modules/PositionModule.cpp index b3294a866..228929e96 100644 --- a/src/modules/PositionModule.cpp +++ b/src/modules/PositionModule.cpp @@ -11,12 +11,12 @@ #include "configuration.h" #include "gps/GeoCoord.h" #include "main.h" +#include "mesh/compression/unishox2.h" #include "meshtastic/atak.pb.h" #include "sleep.h" #include "target_specific.h" extern "C" { -#include "mesh/compression/unishox2.h" #include } @@ -255,10 +255,12 @@ meshtastic_MeshPacket *PositionModule::allocAtakPli() .course = static_cast(localPosition.ground_track), }}}; - auto length = unishox2_compress_simple(owner.long_name, strlen(owner.long_name), takPacket.contact.device_callsign); + auto length = unishox2_compress_lines(owner.long_name, strlen(owner.long_name), takPacket.contact.device_callsign, + sizeof(takPacket.contact.device_callsign) - 1, USX_PSET_DFLT, NULL); LOG_DEBUG("Uncompressed device_callsign '%s' - %d bytes\n", owner.long_name, strlen(owner.long_name)); LOG_DEBUG("Compressed device_callsign '%s' - %d bytes\n", takPacket.contact.device_callsign, length); - length = unishox2_compress_simple(owner.long_name, strlen(owner.long_name), takPacket.contact.callsign); + length = unishox2_compress_lines(owner.long_name, strlen(owner.long_name), takPacket.contact.callsign, + sizeof(takPacket.contact.callsign) - 1, USX_PSET_DFLT, NULL); mp->decoded.payload.size = pb_encode_to_bytes(mp->decoded.payload.bytes, sizeof(mp->decoded.payload.bytes), &meshtastic_TAKPacket_msg, &takPacket); return mp;