VE7UWU/sdrangel
1
0
Fork 0
mirror of https://github.com/f4exb/sdrangel.git synced 2026-08-10 13:33:49 -04:00
Code Issues Projects Releases Wiki Activity

aprs: Fix out-of-bounds access in item parsing

Browse Source 
cppcheck reported an out-of-bounds access in APRSPacket::parseItem()
when parsing item names. The parser checked the string length using an
incorrect boundary condition, allowing an index equal to the string
length to be accessed.

Validate the item terminator before indexing the string, and ensure
malformed packets without a valid terminator are rejected. Also simplify
the item name parsing logic while enforcing the APRS 3-9 character item
name limit.

Signed-off-by: Robin Getz <rgetz503@gmail.com>
This commit is contained in:
Robin Getz
2026-08-01 23:16:15 -04:00
parent e6c3cecb64
commit 08ff033dc3
1 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sdrbase/util/aprs.cpp
+18 -17
View File
@@ -724,28 +724,29 @@ bool APRSPacket::parseObject(QString& info, int& idx)
bool APRSPacket::parseItem(QString& info, int& idx)
{
if (info.length() < idx+3)
// Item names are 3-9 characters long and terminated by '!' or '_'
// Require the minimum 3-character name plus the terminator.
if (info.length() < (idx + 3 + 1))
return false;
// Item names are 3-9 chars long, excluding ! or _
m_objectName = "";
int i;
for (i = 0; i < 10; i++)
m_objectName.clear();
for (int i = 0; (i < 9) && (idx < info.length()); ++i)
{
if (info.length() >= idx)
{
QChar c = info[idx];
if (c == '!' || c == '_')
break;
else
{
m_objectName.append(c);
idx++;
}
}
const QChar c = info[idx];
if (c == '!' || c == '_')
break;
m_objectName.append(c);
++idx;
}
if (i == 11)
if (idx >= info.length())
return false;
if (info[idx] != '!' && info[idx] != '_')
return false;
if (info[idx] == '!')
m_objectLive = true;
else if (info[idx] == '_')