Skip to content

Commit 1d702d5

Browse files
mDNS compressed pointer: Validate offset before jumping
1 parent 85bbb38 commit 1d702d5

File tree

2 files changed

+37
-15
lines changed

2 files changed

+37
-15
lines changed

libraries/ESP8266WiFi/src/include/UdpContext.h

+5-1
Original file line numberDiff line numberDiff line change
@@ -151,10 +151,14 @@ class UdpContext
151151

152152
void seek(const size_t pos)
153153
{
154-
assert(pos <= _rx_buf->len);
154+
assert(isValidOffset(pos));
155155
_rx_buf_offset = pos;
156156
}
157157

158+
bool isValidOffset(const size_t pos) const {
159+
return (pos <= _rx_buf->len);
160+
}
161+
158162
uint32_t getRemoteAddress()
159163
{
160164
if (!_rx_buf)

libraries/ESP8266mDNS/ESP8266mDNS.cpp

+32-14
Original file line numberDiff line numberDiff line change
@@ -550,15 +550,24 @@ void MDNSResponder::_parsePacket(){
550550
}
551551
if (tmp8 & 0xC0) { // Compressed pointer
552552
uint16_t offset = ((((uint16_t)tmp8) & ~0xC0) << 8) | _conn_read8();
553-
last_bufferpos = _conn->tell();
553+
if (_conn->isValidOffset(offset)) {
554+
last_bufferpos = _conn->tell();
554555
#ifdef DEBUG_ESP_MDNS_RX
555-
DEBUG_ESP_PORT.print("Compressed pointer, jumping from ");
556-
DEBUG_ESP_PORT.print(last_bufferpos);
557-
DEBUG_ESP_PORT.print(" to ");
558-
DEBUG_ESP_PORT.println(offset);
556+
DEBUG_ESP_PORT.print("Compressed pointer, jumping from ");
557+
DEBUG_ESP_PORT.print(last_bufferpos);
558+
DEBUG_ESP_PORT.print(" to ");
559+
DEBUG_ESP_PORT.println(offset);
559560
#endif
560-
_conn->seek(offset);
561-
tmp8 = _conn_read8();
561+
_conn->seek(offset);
562+
tmp8 = _conn_read8();
563+
}
564+
else {
565+
#ifdef DEBUG_ESP_MDNS_RX
566+
DEBUG_ESP_PORT.print("Skipping malformed compressed pointer");
567+
#endif
568+
tmp8 = _conn_read8();
569+
break;
570+
}
562571
}
563572
if(stringsRead > 3){
564573
#ifdef DEBUG_ESP_MDNS_RX
@@ -661,15 +670,24 @@ void MDNSResponder::_parsePacket(){
661670
tmp8 = _conn_read8();
662671
if (tmp8 & 0xC0) { // Compressed pointer
663672
uint16_t offset = ((((uint16_t)tmp8) & ~0xC0) << 8) | _conn_read8();
664-
last_bufferpos = _conn->tell();
673+
if (_conn->isValidOffset(offset)) {
674+
last_bufferpos = _conn->tell();
665675
#ifdef DEBUG_ESP_MDNS_RX
666-
DEBUG_ESP_PORT.print("Compressed pointer, jumping from ");
667-
DEBUG_ESP_PORT.print(last_bufferpos);
668-
DEBUG_ESP_PORT.print(" to ");
669-
DEBUG_ESP_PORT.println(offset);
676+
DEBUG_ESP_PORT.print("Compressed pointer, jumping from ");
677+
DEBUG_ESP_PORT.print(last_bufferpos);
678+
DEBUG_ESP_PORT.print(" to ");
679+
DEBUG_ESP_PORT.println(offset);
670680
#endif
671-
_conn->seek(offset);
672-
tmp8 = _conn_read8();
681+
_conn->seek(offset);
682+
tmp8 = _conn_read8();
683+
}
684+
else {
685+
#ifdef DEBUG_ESP_MDNS_RX
686+
DEBUG_ESP_PORT.print("Skipping malformed compressed pointer");
687+
#endif
688+
tmp8 = _conn_read8();
689+
break;
690+
}
673691
}
674692
_conn_readS(answerHostName, tmp8);
675693
answerHostName[tmp8] = '\0';

0 commit comments

Comments
 (0)