espressif/esp-protocols
1
0
Fork 1
mirror of https://github.com/espressif/esp-protocols.git synced 2026-07-07 17:10:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(mdns): bounds-copy browse service/proto when parsing packets

Browse Source 
browse_init stores service and proto with strlen+1 allocations, but
packet parsing copied MDNS_NAME_BUF_LEN bytes into browse snapshots.
This commit is contained in:
David Cermak
2026-05-27 15:06:34 +02:00
parent b556327e9b
commit 429d7b91a2
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mdns/mdns_receive.c
+4 -2
View File
@@ -829,7 +829,8 @@ static void mdns_parse_packet(mdns_rx_packet_t *packet)
goto clear_rx_packet;
}
}
memcpy(browse_result_service, browse_result->service, MDNS_NAME_BUF_LEN);
strncpy(browse_result_service, browse_result->service, MDNS_NAME_BUF_LEN - 1);
browse_result_service[MDNS_NAME_BUF_LEN - 1] = '\0';
if (!browse_result_proto) {
browse_result_proto = (char *)mdns_mem_malloc(MDNS_NAME_BUF_LEN);
if (!browse_result_proto) {
@@ -837,7 +838,8 @@ static void mdns_parse_packet(mdns_rx_packet_t *packet)
goto clear_rx_packet;
}
}
memcpy(browse_result_proto, browse_result->proto, MDNS_NAME_BUF_LEN);
strncpy(browse_result_proto, browse_result->proto, MDNS_NAME_BUF_LEN - 1);
browse_result_proto[MDNS_NAME_BUF_LEN - 1] = '\0';
if (type == MDNS_TYPE_SRV || type == MDNS_TYPE_TXT) {
if (!browse_result_instance) {
browse_result_instance = (char *)mdns_mem_malloc(MDNS_NAME_BUF_LEN);