BodgeMaster
/
NORM-mirror
mirror of https://github.com/USNavalResearchLaboratory/norm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Some safety fixes (#101) 

* Fix uninitialized memory read vulnerability in packet validation

* Fix buffer overflows in temporary file generation
pull/103/head
Joe Calderon 2026-07-03 09:01:20 -07:00 committed by GitHub
parent d6b4695c4c
commit 75a3dd59ee
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 8 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/common/normApi.cpp
View File

@ -271,29 +271,12 @@ void NormInstance::Notify(NormController::Event event,
if (NULL != rx_cache_path)
{
char fileName[PATH_MAX];
strncpy(fileName, rx_cache_path, PATH_MAX);
size_t catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strncat(fileName, "normTempXXXXXX", catMax);
#ifdef WIN32
#ifdef _WIN32_WCE
bool tempFileOK = false;
for (int i = 0; i < 255; i++)
{
strncpy(fileName, rx_cache_path, PATH_MAX);
catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strncat(fileName, "normTempXXXXXX", catMax);
char tempName[16];
sprintf(tempName, "normTemp%06u", i);
strcat(fileName, tempName);
snprintf(fileName, PATH_MAX, "%snormTemp%06u", rx_cache_path, i);
if(!NormFile::IsLocked(fileName))
{
tempFileOK = true;
@ -302,9 +285,11 @@ void NormInstance::Notify(NormController::Event event,
}
if (!tempFileOK)
#else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
if (!_mktemp(fileName))
#endif // if/else _WIN32_WCE
#else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
int fd = mkstemp(fileName);
if (fd >= 0)
{

20
src/common/normApp.cpp
View File

@ -1718,28 +1718,12 @@ void NormApp::Notify(NormController::Event event,
// we can use that for file name right away ???
// (TBD) Manage recv file name collisions, etc ...
char fileName[PATH_MAX];
strcpy(fileName, rx_cache_path);
size_t catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strcat(fileName, "normTempXXXXXX");
#ifdef WIN32
#ifdef _WIN32_WCE
bool tempFileOK = false;
for (int i = 0; i < 255; i++)
{
strncpy(fileName, rx_cache_path, PATH_MAX);
catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strncat(fileName, "normTempXXXXXX", catMax);
char tempName[16];
sprintf(tempName, "normTemp%06u", i);
strcat(fileName, tempName);
snprintf(fileName, PATH_MAX, "%snormTemp%06u", rx_cache_path, i);
if(!NormFile::IsLocked(fileName))
{
tempFileOK = true;
@ -1748,9 +1732,11 @@ void NormApp::Notify(NormController::Event event,
}
if (!tempFileOK)
#else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
if (!_mktemp(fileName))
#endif // if/else _WIN32_WCE
#else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
int fd = mkstemp(fileName);
if (fd >= 0)
{

2
src/common/normMessage.cpp
View File

@ -79,7 +79,7 @@ bool NormMsg::InitFromBuffer(UINT16 msgLength)
PLOG(PL_FATAL, "NormMsg::InitFromBuffer() invalid message type!\n");
return false;
}
if (msgLength < header_length)
if ((msgLength < header_length) || (header_length < header_length_base))
{
PLOG(PL_FATAL, "NormMsg::InitFromBuffer() invalid message or header length\n");
return false;

2
wscript
View File

@ -47,7 +47,7 @@ system = platform.system().lower()
def options(ctx):
ctx.recurse('protolib')
build_opts = ctx.parser.add_argument_group('Compile/install Options', 'Use during build/install step.')
build_opts = ctx.add_option_group('Compile/install Options', 'Use during build/install step.')
# Add Rust binding options
ctx.add_option('--build-rust', action='store_true', default=False,