weston-embedded/uC-TCP-IP

Add/Fix out-of-bounds check in array access.

Closed this issue · 0 comments

The variable 'if_nbr' passed to NetBuf_Discard() needs to be checked for validity. This only becomes a problem if NET_ERR_CFG_ARG_CHK_DBG_EN is disabled.

The following line:

NET_CTR_ERR_INC(Net_ErrCtrs.IFs.IF[if_nbr].BufLostCtr);

(A) needs to be modified as:

if (if_nbr < NET_IF_NBR_IF_TOT) {
NET_CTR_ERR_INC(Net_ErrCtrs.IFs.IF[if_nbr].BufLostCtr);
}

in NetBuf_Discard()

OR (B) the check in the NetBuf_FreeHandler() -> NetBuf_Discard() path needs to have removed the
#if (NET_ERR_CFG_ARG_CHK_DBG_EN == DEF_ENABLED) conditional preprocessor directive that encloses NetIF_IsValidHandler() in NetBuf_FreeHandler(). This way this path will resemble the other two paths that lead to NetBuf_Discard(); which don't have this preprocessor directive.