From cf7f0f9d0895602df3453a4f5cfea843f4e09744 Mon Sep 17 00:00:00 2001 From: dfsx1 <60702962+dfsx1@users.noreply.github.com> Date: Sun, 23 Mar 2025 10:49:06 +0000 Subject: [PATCH] Fix NodeInfo exploit overwriting publicKey in NodeDB (#6372) Co-authored-by: dfsx1 --- src/mesh/NodeDB.cpp | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/mesh/NodeDB.cpp b/src/mesh/NodeDB.cpp index a9130c3a9..666276f83 100644 --- a/src/mesh/NodeDB.cpp +++ b/src/mesh/NodeDB.cpp @@ -1437,13 +1437,14 @@ bool NodeDB::updateUser(uint32_t nodeId, meshtastic_User &p, uint8_t channelInde #if !(MESHTASTIC_EXCLUDE_PKI) if (p.public_key.size > 0) { printBytes("Incoming Pubkey: ", p.public_key.bytes, 32); - if (info->user.public_key.size > 0) { // if we have a key for this user already, don't overwrite with a new one - LOG_INFO("Public Key set for node, not updating!"); - // we copy the key into the incoming packet, to prevent overwrite - memcpy(p.public_key.bytes, info->user.public_key.bytes, 32); - } else { - LOG_INFO("Update Node Pubkey!"); - } + } + if (info->user.public_key.size > 0) { // if we have a key for this user already, don't overwrite with a new one + LOG_INFO("Public Key set for node, not updating!"); + // we copy the key into the incoming packet, to prevent overwrite + p.public_key.size = 32; + memcpy(p.public_key.bytes, info->user.public_key.bytes, 32); + } else if (p.public_key.size > 0) { + LOG_INFO("Update Node Pubkey!"); } #endif