Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

tcp_transport: fix possible buffer overflow in ws transport connect

Browse source 
closes IDF-692
This commit is contained in:
David Cermak 2019-08-23 16:36:42 +02:00 committed by bot
parent e2897f4d4a
commit 555cc11a25
1 changed files with 16 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
components/tcp_transport/transport_ws.c
View file

@ -103,14 +103,26 @@ static int ws_connect(esp_transport_handle_t t, const char *host, int port, int
ws->path, ws->path,
host, port, host, port,
client_key); client_key);
if (ws->sub_protocol) {
len += snprintf(ws->buffer + len, DEFAULT_WS_BUFFER - len, "Sec-WebSocket-Protocol: %s\r\n", ws->sub_protocol);
}
len += snprintf(ws->buffer + len, DEFAULT_WS_BUFFER - len, "\r\n");
if (len <= 0 || len >= DEFAULT_WS_BUFFER) { if (len <= 0 || len >= DEFAULT_WS_BUFFER) {
ESP_LOGE(TAG, "Error in request generation, %d", len); ESP_LOGE(TAG, "Error in request generation, %d", len);
return -1; return -1;
} }
if (ws->sub_protocol) {
int r = snprintf(ws->buffer + len, DEFAULT_WS_BUFFER - len, "Sec-WebSocket-Protocol: %s\r\n", ws->sub_protocol);
len += r;
if (r <= 0 || len >= DEFAULT_WS_BUFFER) {
ESP_LOGE(TAG, "Error in request generation"
"(snprintf of subprotocol returned %d, desired request len: %d, buffer size: %d", r, len, DEFAULT_WS_BUFFER);
return -1;
}
}
int r = snprintf(ws->buffer + len, DEFAULT_WS_BUFFER - len, "\r\n");
len += r;
if (r <= 0 || len >= DEFAULT_WS_BUFFER) {
ESP_LOGE(TAG, "Error in request generation"
"(snprintf of header terminal returned %d, desired request len: %d, buffer size: %d", r, len, DEFAULT_WS_BUFFER);
return -1;
}
ESP_LOGD(TAG, "Write upgrate request\r\n%s", ws->buffer); ESP_LOGD(TAG, "Write upgrate request\r\n%s", ws->buffer);
if (esp_transport_write(ws->parent, ws->buffer, len, timeout_ms) <= 0) { if (esp_transport_write(ws->parent, ws->buffer, len, timeout_ms) <= 0) {
ESP_LOGE(TAG, "Error write Upgrade header %s", ws->buffer); ESP_LOGE(TAG, "Error write Upgrade header %s", ws->buffer);