From 08ff033dc33a47751b0a8a4c977d3e8457b1dd44 Mon Sep 17 00:00:00 2001 From: Robin Getz Date: Sat, 1 Aug 2026 23:16:15 -0400 Subject: [PATCH] aprs: Fix out-of-bounds access in item parsing cppcheck reported an out-of-bounds access in APRSPacket::parseItem() when parsing item names. The parser checked the string length using an incorrect boundary condition, allowing an index equal to the string length to be accessed. Validate the item terminator before indexing the string, and ensure malformed packets without a valid terminator are rejected. Also simplify the item name parsing logic while enforcing the APRS 3-9 character item name limit. Signed-off-by: Robin Getz --- sdrbase/util/aprs.cpp | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/sdrbase/util/aprs.cpp b/sdrbase/util/aprs.cpp index c0dc12d5c..2f810ad36 100644 --- a/sdrbase/util/aprs.cpp +++ b/sdrbase/util/aprs.cpp @@ -724,28 +724,29 @@ bool APRSPacket::parseObject(QString& info, int& idx) bool APRSPacket::parseItem(QString& info, int& idx) { - if (info.length() < idx+3) + // Item names are 3-9 characters long and terminated by '!' or '_' + // Require the minimum 3-character name plus the terminator. + if (info.length() < (idx + 3 + 1)) return false; - // Item names are 3-9 chars long, excluding ! or _ - m_objectName = ""; - int i; - for (i = 0; i < 10; i++) + m_objectName.clear(); + + for (int i = 0; (i < 9) && (idx < info.length()); ++i) { - if (info.length() >= idx) - { - QChar c = info[idx]; - if (c == '!' || c == '_') - break; - else - { - m_objectName.append(c); - idx++; - } - } + const QChar c = info[idx]; + if (c == '!' || c == '_') + break; + + m_objectName.append(c); + ++idx; } - if (i == 11) + + if (idx >= info.length()) return false; + + if (info[idx] != '!' && info[idx] != '_') + return false; + if (info[idx] == '!') m_objectLive = true; else if (info[idx] == '_')