Skip to content

Possible exploit in RF24Network affecting Arduino devices? #272

Description

@TMRh20

Just watched the memory on my ESP8266 get thrashed down to nothing in a short period of time.

I think this is why, no checking on the incoming payload to see if it exceeds memory space:

RF24Network/RF24Network.cpp

Lines 506 to 517 in e52709f

else //else is not a fragment
#endif // End fragmentation enabled
// Copy the current frame into the frame queue
#if !defined(DISABLE_FRAGMENTATION)
if (header->type == EXTERNAL_DATA_TYPE)
{
memcpy((char*)(&frag_queue), &frame_buffer, 8);
memcpy(frag_queue.message_buffer, frame_buffer + sizeof(RF24NetworkHeader), message_size);
frag_queue.message_size = message_size;
return 2;
}

    }
    else //else is not a fragment
    #endif // End fragmentation enabled

    // Copy the current frame into the frame queue
    #if !defined(DISABLE_FRAGMENTATION)
        if (header->type == EXTERNAL_DATA_TYPE && (MAX_PAYLOAD_SIZE - (next_frame - frame_queue)) >= message_size )   //<< MODIFY THIS LINE
    {
        memcpy((char*)(&frag_queue), &frame_buffer, 8);
        memcpy(frag_queue.message_buffer, frame_buffer + sizeof(RF24NetworkHeader), message_size);
        frag_queue.message_size = message_size;
        return 2;
    }
    #endif

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions