Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Null Pointer Dereference in TCP Packet Handling #36751

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Fix Null Pointer Dereference in TCP Packet Handling #36751

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
404db44
Fix Null Pointer Dereference in TCP Packet Handling
BoB13-Matter Dec 6, 2024
ad04055
Fix handle zero messageSize in TCP packet processing
Dec 10, 2024
f494cd9
Add test for TCP MessageSize
BoB13-Matter Dec 17, 2024
196fe48
Modify test
BoB13-Matter Dec 17, 2024
cca52cd
Restyled by clang-format
restyled-commits Dec 17, 2024
d9316a2
Modify the position of an if statement
BoB13-Matter Dec 18, 2024
042819f
Modify test
BoB13-Matter Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/transport/raw/TCP.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,7 +343,15 @@ CHIP_ERROR TCPBase::ProcessReceivedBuffer(Inet::TCPEndPoint * endPoint, const Pe
// We have not yet received the complete message.
return CHIP_NO_ERROR;
}

state->mReceived.Consume(kPacketSizeBytes);

if (messageSize == 0)
{
// No payload but considered a valid message. Return success to keep the connection alive.
return CHIP_NO_ERROR;
BoB13-Matter marked this conversation as resolved.
Show resolved Hide resolved
}

ReturnErrorOnFailure(ProcessSingleMessage(peerAddress, state, messageSize));
}

Expand Down
9 changes: 8 additions & 1 deletion src/transport/raw/tests/TestTCP.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,8 @@ constexpr NodeId kSourceNodeId = 123654;
constexpr NodeId kDestinationNodeId = 111222333;
constexpr uint32_t kMessageCounter = 18;

const char PAYLOAD[] = "Hello!";
const char PAYLOAD[] = "Hello!";
const char messageSize_TEST[] = "\x00\x00\x00\x00";

class MockTransportMgrDelegate : public chip::TransportMgrDelegate
{
Expand Down Expand Up @@ -633,6 +634,12 @@ TEST_F(TestTCP, CheckProcessReceivedBuffer)
TestData testData[2];
gMockTransportMgrDelegate.SetCallback(TestDataCallbackCheck, testData);

// Test a single packet buffer with zero message size.
System::PacketBufferHandle buf = System::PacketBufferHandle::NewWithData(messageSize_TEST, 4);
ASSERT_NE(&buf, nullptr);
err = TestAccess::ProcessReceivedBuffer(tcp, lEndPoint, lPeerAddress, std::move(buf));
EXPECT_EQ(err, CHIP_NO_ERROR);

// Test a single packet buffer.
gMockTransportMgrDelegate.mReceiveHandlerCallCount = 0;
EXPECT_TRUE(testData[0].Init((const uint32_t[]){ 111, 0 }));
Expand Down
Loading