From fdbb285deeb640c1ad35f29a04b075df517316ba Mon Sep 17 00:00:00 2001 From: Olivier Date: Tue, 6 Dec 2016 15:45:27 +0100 Subject: [PATCH] Fix payload length verification (#680) --- core/MyTransport.cpp | 7 ++++++- core/MyTransportNRF24.cpp | 4 +++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/core/MyTransport.cpp b/core/MyTransport.cpp index 9c508b4..5d3a1ca 100644 --- a/core/MyTransport.cpp +++ b/core/MyTransport.cpp @@ -554,11 +554,16 @@ void transportProcessMessage(void) { (void)signerCheckTimer(); // receive message setIndication(INDICATION_RX); - const uint8_t payloadLength = transportReceive((uint8_t *)&_msg); + uint8_t payloadLength = transportReceive((uint8_t *)&_msg); // get message length and limit size + const uint8_t msgLength = min(mGetLength(_msg), (uint8_t)MAX_PAYLOAD); // calculate expected length const uint8_t expectedMessageLength = HEADER_SIZE + (mGetSigned(_msg) ? MAX_PAYLOAD : msgLength); +#if defined(MY_RF24_ENABLE_ENCRYPTION) + // payload length = a multiple of blocksize length for decrypted messages, i.e. cannot be used for payload length check + payloadLength = expectedMessageLength; +#endif const uint8_t command = mGetCommand(_msg); const uint8_t type = _msg.type; const uint8_t sender = _msg.sender; diff --git a/core/MyTransportNRF24.cpp b/core/MyTransportNRF24.cpp index 9a21a25..e1d6ba4 100644 --- a/core/MyTransportNRF24.cpp +++ b/core/MyTransportNRF24.cpp @@ -141,7 +141,9 @@ uint8_t transportReceive(void* data) // has to be adjusted, WIP! _aes.set_IV(0); // decrypt data - _aes.cbc_decrypt((byte*)(data), (byte*)(data), len>16?2:1); + if (_aes.cbc_decrypt((uint8_t*)(data), (uint8_t*)(data), len > 16 ? 2 : 1) != AES_SUCCESS) { + len = 0; + } #endif return len; }