socket.recvfrom() buffer overflow? [imported]

[cmaglie]

This is Issue 355 moved from a Google Code project.
Added by 2010-09-22T16:39:07.000Z by [email protected].
Please review that bug for more context and additional comments, but update this bug.

Original labels: Type-Defect, Priority-Medium

Original description

recvfrom() doesn't check data_len received from W5100.read_data before using it to read into *buf:

maybe indicates more basic problem in w5100 library?

---

from socket.cpp:

  data_len = head[6];
  data_len = (data_len << 8) + head[7];

  // here should be (data_len > len) test

  W5100.read_data(s, (uint8_t *)ptr, buf, data_len); // data copy.

---

[PaulStoffregen]

Fixed in Ethernet 2.0.0.

The recvfrom() function was removed and implemented directly in EthernetUDP parsePacket() and read(). The read() function does indeed check buffer size.

Closing this old issue.