From 56fa9bcd661c9509bcab1d7c44be006e8298a8ab Mon Sep 17 00:00:00 2001 From: Wessel Nieboer Date: Wed, 11 Feb 2026 04:16:44 +0100 Subject: [PATCH] fix out_frame buffer overflow in companion radio response handlers The onContactResponse handler copies peer response data into out_frame (MAX_FRAME_SIZE + 1 bytes) without checking whether the data fits. A peer response with len close to MAX_PACKET_PAYLOAD (184) writes up to 188 bytes into the 173-byte buffer, overflowing by 15 bytes. This affects the status response, telemetry response, and binary response code paths. A malicious peer can trigger the overflow by sending a large response payload, corrupting the stack. Cap each memcpy to the remaining space in out_frame before copying. --- examples/companion_radio/MyMesh.cpp | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/examples/companion_radio/MyMesh.cpp b/examples/companion_radio/MyMesh.cpp index a9ac1cf0a..dbfb813f6 100644 --- a/examples/companion_radio/MyMesh.cpp +++ b/examples/companion_radio/MyMesh.cpp @@ -635,8 +635,10 @@ void MyMesh::onContactResponse(const ContactInfo &contact, const uint8_t *data, out_frame[i++] = 0; // reserved memcpy(&out_frame[i], contact.id.pub_key, 6); i += 6; // pub_key_prefix - memcpy(&out_frame[i], &data[4], len - 4); - i += (len - 4); + int copy_len = len - 4; + if (copy_len > MAX_FRAME_SIZE - i) copy_len = MAX_FRAME_SIZE - i; + memcpy(&out_frame[i], &data[4], copy_len); + i += copy_len; _serial->writeFrame(out_frame, i); } else if (len > 4 && tag == pending_telemetry) { // check for matching response tag pending_telemetry = 0; @@ -646,8 +648,10 @@ void MyMesh::onContactResponse(const ContactInfo &contact, const uint8_t *data, out_frame[i++] = 0; // reserved memcpy(&out_frame[i], contact.id.pub_key, 6); i += 6; // pub_key_prefix - memcpy(&out_frame[i], &data[4], len - 4); - i += (len - 4); + int copy_len = len - 4; + if (copy_len > MAX_FRAME_SIZE - i) copy_len = MAX_FRAME_SIZE - i; + memcpy(&out_frame[i], &data[4], copy_len); + i += copy_len; _serial->writeFrame(out_frame, i); } else if (len > 4 && tag == pending_req) { // check for matching response tag pending_req = 0; @@ -657,8 +661,10 @@ void MyMesh::onContactResponse(const ContactInfo &contact, const uint8_t *data, out_frame[i++] = 0; // reserved memcpy(&out_frame[i], &tag, 4); // app needs to match this to RESP_CODE_SENT.tag i += 4; - memcpy(&out_frame[i], &data[4], len - 4); - i += (len - 4); + int copy_len = len - 4; + if (copy_len > MAX_FRAME_SIZE - i) copy_len = MAX_FRAME_SIZE - i; + memcpy(&out_frame[i], &data[4], copy_len); + i += copy_len; _serial->writeFrame(out_frame, i); } }