Fix vulnerability with "h.from == 0"

// altered packed with "from == 0" can do Remote Node Administration without permission
This commit is contained in:
a_filonichev 2023-01-20 01:38:13 +02:00
parent 48ea836a5c
commit 3eaa054c68

View File

@ -347,7 +347,11 @@ QueueStatus RadioLibInterface::getQueueStatus()
airTime->logAirtime(RX_ALL_LOG, xmitMsec);
} else {
const PacketHeader *h = (PacketHeader *)radiobuf;
// altered packed with "from == 0" can do Remote Node Administration without permission
if (h->from == 0) {
LOG_WARN("ignoring received packet without sender\n");
return;
}
rxGood++;
// Note: we deliver _all_ packets to our router (i.e. our interface is intentionally promiscuous).