Skip to content

Commit e4d6dd4

Browse files
kkasperczyk-nokkasperczyk-no
committed
Replaced str... with strn... methods
Static code analysis shown that there are several places that str.. methods are used, what may lead to the bad memory access. Replaced all of them with corresponding strn... methods.
1 parent 4fa81f6 commit e4d6dd4

File tree

9 files changed

+31
-22
lines changed

9 files changed

+31
-22
lines changed

‎src/app/server/Server.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -695,7 +695,7 @@ CHIP_ERROR Server::SendUserDirectedCommissioningRequest(Transport::PeerAddress c
695695
CHIP_ERROR err;
696696

697697
// only populate fields left blank by the client
698-
if (strlen(id.GetInstanceName()) == 0)
698+
if (strnlen(id.GetInstanceName(), Dnssd::Commission::kInstanceNameMaxLength + 1) == 0)
699699
{
700700
ChipLogDetail(AppServer, "Server::SendUserDirectedCommissioningRequest() Instance Name not known");
701701
char nameBuffer[Dnssd::Commission::kInstanceNameMaxLength + 1];
@@ -738,7 +738,7 @@ CHIP_ERROR Server::SendUserDirectedCommissioningRequest(Transport::PeerAddress c
738738
}
739739
}
740740

741-
if (strlen(id.GetDeviceName()) == 0)
741+
if (strnlen(id.GetDeviceName(), Dnssd::kKeyDeviceNameMaxLength + 1) == 0)
742742
{
743743
char deviceName[Dnssd::kKeyDeviceNameMaxLength + 1] = {};
744744
if (!DeviceLayer::ConfigurationMgr().IsCommissionableDeviceNameEnabled() ||

‎src/inet/InetInterface.cpp

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ namespace Inet {
6969
#if CHIP_SYSTEM_CONFIG_USE_OPEN_THREAD_ENDPOINT
7070
CHIP_ERROR InterfaceId::GetInterfaceName(char * nameBuf, size_t nameBufSize) const
7171
{
72-
if (mPlatformInterface && nameBufSize >= kMaxIfNameLength)
72+
if (mPlatformInterface && nameBufSize >= InterfaceId::kMaxIfNameLength)
7373
{
7474
nameBuf[0] = 'o';
7575
nameBuf[1] = 't';
@@ -84,7 +84,7 @@ CHIP_ERROR InterfaceId::GetInterfaceName(char * nameBuf, size_t nameBufSize) con
8484
}
8585
CHIP_ERROR InterfaceId::InterfaceNameToId(const char * intfName, InterfaceId & interface)
8686
{
87-
if (strlen(intfName) < 3)
87+
if (strnlen(intfName, kMaxIfNameLength) < 3)
8888
{
8989
return INET_ERROR_UNKNOWN_INTERFACE;
9090
}
@@ -210,7 +210,7 @@ CHIP_ERROR InterfaceId::GetInterfaceName(char * nameBuf, size_t nameBufSize) con
210210

211211
CHIP_ERROR InterfaceId::InterfaceNameToId(const char * intfName, InterfaceId & interface)
212212
{
213-
if (strlen(intfName) < 3)
213+
if (strnlen(intfName, InterfaceId::kMaxIfNameLength) < 3)
214214
{
215215
return INET_ERROR_UNKNOWN_INTERFACE;
216216
}
@@ -445,7 +445,7 @@ CHIP_ERROR InterfaceId::GetInterfaceName(char * nameBuf, size_t nameBufSize) con
445445
{
446446
return CHIP_ERROR_POSIX(errno);
447447
}
448-
size_t nameLength = strlen(intfName);
448+
size_t nameLength = strnlen(intfName, IF_NAMESIZE);
449449
if (nameLength >= nameBufSize)
450450
{
451451
return CHIP_ERROR_BUFFER_TOO_SMALL;
@@ -579,7 +579,8 @@ InterfaceId InterfaceIterator::GetInterfaceId()
579579
CHIP_ERROR InterfaceIterator::GetInterfaceName(char * nameBuf, size_t nameBufSize)
580580
{
581581
VerifyOrReturnError(HasCurrent(), CHIP_ERROR_INCORRECT_STATE);
582-
VerifyOrReturnError(strlen(mIntfArray[mCurIntf].if_name) < nameBufSize, CHIP_ERROR_BUFFER_TOO_SMALL);
582+
VerifyOrReturnError(strnlen(mIntfArray[mCurIntf].if_name, InterfaceId::kMaxIfNameLength) < nameBufSize,
583+
CHIP_ERROR_BUFFER_TOO_SMALL);
583584
Platform::CopyString(nameBuf, nameBufSize, mIntfArray[mCurIntf].if_name);
584585
return CHIP_NO_ERROR;
585586
}
@@ -728,7 +729,7 @@ InterfaceId InterfaceAddressIterator::GetInterfaceId()
728729
CHIP_ERROR InterfaceAddressIterator::GetInterfaceName(char * nameBuf, size_t nameBufSize)
729730
{
730731
VerifyOrReturnError(HasCurrent(), CHIP_ERROR_INCORRECT_STATE);
731-
VerifyOrReturnError(strlen(mCurAddr->ifa_name) < nameBufSize, CHIP_ERROR_BUFFER_TOO_SMALL);
732+
VerifyOrReturnError(strnlen(mCurAddr->ifa_name, InterfaceId::kMaxIfNameLength) < nameBufSize, CHIP_ERROR_BUFFER_TOO_SMALL);
732733
Platform::CopyString(nameBuf, nameBufSize, mCurAddr->ifa_name);
733734
return CHIP_NO_ERROR;
734735
}
@@ -802,7 +803,7 @@ CHIP_ERROR InterfaceId::GetInterfaceName(char * nameBuf, size_t nameBufSize) con
802803
return CHIP_ERROR_INCORRECT_STATE;
803804
}
804805
const char * name = net_if_get_device(currentInterface)->name;
805-
size_t nameLength = strlen(name);
806+
size_t nameLength = strnlen(name, InterfaceId::kMaxIfNameLength);
806807
if (nameLength >= nameBufSize)
807808
{
808809
return CHIP_ERROR_BUFFER_TOO_SMALL;
@@ -825,7 +826,7 @@ CHIP_ERROR InterfaceId::InterfaceNameToId(const char * intfName, InterfaceId & i
825826

826827
while ((currentInterface = net_if_get_by_index(++currentId)) != nullptr)
827828
{
828-
if (strcmp(net_if_get_device(currentInterface)->name, intfName) == 0)
829+
if (strncmp(net_if_get_device(currentInterface)->name, intfName, InterfaceId::kMaxIfNameLength) == 0)
829830
{
830831
interface = InterfaceId(currentId);
831832
return CHIP_NO_ERROR;

‎src/inet/UDPEndPointImplSockets.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,8 @@ CHIP_ERROR UDPEndPointImplSockets::BindInterfaceImpl(IPAddressType addressType,
234234
{
235235
status = CHIP_ERROR_POSIX(errno);
236236
}
237-
else if (setsockopt(mSocket, SOL_SOCKET, SO_BINDTODEVICE, interfaceName, socklen_t(strlen(interfaceName))) == -1)
237+
else if (setsockopt(mSocket, SOL_SOCKET, SO_BINDTODEVICE, interfaceName, socklen_t(strnlen(interfaceName, IF_NAMESIZE))) ==
238+
-1)
238239
{
239240
status = CHIP_ERROR_POSIX(errno);
240241
}

‎src/lib/dnssd/Discovery_ImplPlatform.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,15 +102,16 @@ static void HandleNodeBrowse(void * context, DnssdService * services, size_t ser
102102
auto & ipAddress = services[i].mAddress;
103103

104104
// mType(service name) exactly matches with operational service name
105-
bool isOperationalBrowse = strcmp(services[i].mType, kOperationalServiceName) == 0;
105+
bool isOperationalBrowse = strncmp(services[i].mType, kOperationalServiceName, kDnssdTypeMaxSize + 1) == 0;
106106

107107
// For operational browse result we currently don't need IP address hence skip resolution and handle differently.
108108
if (isOperationalBrowse)
109109
{
110110
HandleNodeOperationalBrowse(context, &services[i], error);
111111
}
112112
// check whether SRV, TXT and AAAA records were received in DNS responses
113-
else if (strlen(services[i].mHostName) == 0 || services[i].mTextEntrySize == 0 || !ipAddress.has_value())
113+
else if (strnlen(services[i].mHostName, chip::Dnssd::kHostNameMaxLength + 1) == 0 || services[i].mTextEntrySize == 0 ||
114+
!ipAddress.has_value())
114115
{
115116
ChipDnssdResolve(&services[i], services[i].mInterface, HandleNodeResolve, context);
116117
}

‎src/lib/dnssd/Types.h

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,8 @@ struct DiscoveryFilter
6464
}
6565
if (type == DiscoveryFilterType::kInstanceName)
6666
{
67-
return (instanceName != nullptr) && (other.instanceName != nullptr) && (strcmp(instanceName, other.instanceName) == 0);
67+
return (instanceName != nullptr) && (other.instanceName != nullptr) &&
68+
(strncmp(instanceName, other.instanceName, Common::kInstanceNameMaxLength + 1) == 0);
6869
}
6970

7071
return code == other.code;
@@ -121,7 +122,7 @@ struct CommonResolutionData
121122
(mrpRetryIntervalActive.has_value() && (*mrpRetryIntervalActive > defaultMRPConfig->mActiveRetransTimeout));
122123
}
123124

124-
bool IsHost(const char * host) const { return strcmp(host, hostName) == 0; }
125+
bool IsHost(const char * host) const { return strncmp(host, hostName, kHostNameMaxLength + 1) == 0; }
125126

126127
void Reset()
127128
{
@@ -244,7 +245,10 @@ struct CommissionNodeData : public CommonResolutionData
244245
new (this) CommissionNodeData();
245246
}
246247

247-
bool IsInstanceName(const char * instance) const { return strcmp(instance, instanceName) == 0; }
248+
bool IsInstanceName(const char * instance) const
249+
{
250+
return strncmp(instance, instanceName, Common::kInstanceNameMaxLength + 1) == 0;
251+
}
248252

249253
void LogDetail() const
250254
{
@@ -257,7 +261,7 @@ struct CommissionNodeData : public CommonResolutionData
257261
Encoding::BytesToUppercaseHexString(rotatingId, rotatingIdLen, rotatingIdString, sizeof(rotatingIdString));
258262
ChipLogDetail(Discovery, "\tRotating ID: %s", rotatingIdString);
259263
}
260-
if (strlen(deviceName) != 0)
264+
if (strnlen(deviceName, kMaxDeviceNameLen + 1) != 0)
261265
{
262266
ChipLogDetail(Discovery, "\tDevice Name: %s", deviceName);
263267
}
@@ -277,7 +281,7 @@ struct CommissionNodeData : public CommonResolutionData
277281
{
278282
ChipLogDetail(Discovery, "\tLong Discriminator: %u", longDiscriminator);
279283
}
280-
if (strlen(pairingInstruction) != 0)
284+
if (strnlen(pairingInstruction, kMaxPairingInstructionLen + 1) != 0)
281285
{
282286
ChipLogDetail(Discovery, "\tPairing Instruction: %s", pairingInstruction);
283287
}

‎src/platform/Zephyr/BLEManagerImpl.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ inline CHIP_ERROR BLEManagerImpl::PrepareAdvertisingRequest()
297297
static_assert(sizeof(serviceData) == 10, "Unexpected size of BLE advertising data!");
298298

299299
const char * name = bt_get_name();
300-
const uint8_t nameSize = static_cast<uint8_t>(strlen(name));
300+
const uint8_t nameSize = static_cast<uint8_t>(strnlen(name, CONFIG_BT_DEVICE_NAME_MAX));
301301

302302
Encoding::LittleEndian::Put16(serviceData.uuid, UUID16_CHIPoBLEService.val);
303303
ReturnErrorOnFailure(ConfigurationMgr().GetBLEDeviceIdentificationInfo(serviceData.deviceIdInfo));

‎src/platform/Zephyr/KeyValueStoreManagerImpl.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ constexpr size_t kEmptyValueSize = sizeof(kEmptyValue);
5656
CHIP_ERROR MakeFullKey(char (&fullKey)[SETTINGS_MAX_NAME_LEN + 1], const char * key)
5757
{
5858
VerifyOrReturnError(key != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
59-
strcpy(fullKey, CHIP_DEVICE_CONFIG_SETTINGS_KEY "/");
59+
strncpy(fullKey, CHIP_DEVICE_CONFIG_SETTINGS_KEY "/", SETTINGS_MAX_NAME_LEN + 1);
6060

6161
char * dest = fullKey + strlen(CHIP_DEVICE_CONFIG_SETTINGS_KEY "/");
6262
char * destEnd = fullKey + SETTINGS_MAX_NAME_LEN;

‎src/platform/Zephyr/Logging.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ void ENFORCE_FORMAT(3, 0) LogV(const char * module, uint8_t category, const char
4747
char formattedMsg[CHIP_CONFIG_LOG_MESSAGE_MAX_SIZE];
4848
snprintfcb(formattedMsg, sizeof(formattedMsg), "[%s]", module);
4949

50-
const size_t prefixLen = strlen(formattedMsg);
50+
const size_t prefixLen = strnlen(formattedMsg, CHIP_CONFIG_LOG_MESSAGE_MAX_SIZE);
5151
vsnprintfcb(formattedMsg + prefixLen, sizeof(formattedMsg) - prefixLen, msg, v);
5252

5353
const char * allocatedMsg = formattedMsg;

‎src/platform/Zephyr/ZephyrConfig.cpp

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
#include <platform/internal/testing/ConfigUnitTest.h>
3232

3333
#include <zephyr/settings/settings.h>
34+
#include <zephyr/storage/flash_map.h>
3435

3536
namespace chip {
3637
namespace DeviceLayer {
@@ -229,6 +230,7 @@ CHIP_ERROR ZephyrConfig::WriteConfigValue(Key key, uint64_t val)
229230

230231
CHIP_ERROR ZephyrConfig::WriteConfigValueStr(Key key, const char * str)
231232
{
233+
/* The API contract requires using null-terminated string, so using strlen here should be safe. */
232234
return WriteConfigValueStr(key, str, str ? strlen(str) : 0);
233235
}
234236

@@ -291,7 +293,7 @@ void ZephyrConfig::RunConfigUnitTest()
291293
bool ZephyrConfig::BuildCounterConfigKey(::chip::Platform::PersistedStorage::Key counterId, char key[SETTINGS_MAX_NAME_LEN])
292294
{
293295
constexpr size_t KEY_PREFIX_LEN = sizeof(NAMESPACE_COUNTERS) - 1;
294-
const size_t keySuffixLen = strlen(counterId) + 1; // including null-character
296+
const size_t keySuffixLen = strnlen(counterId, SETTINGS_MAX_NAME_LEN) + 1; // including null-character
295297

296298
if (KEY_PREFIX_LEN + keySuffixLen > SETTINGS_MAX_NAME_LEN)
297299
return false;

0 commit comments

Comments
 (0)