Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WaspBG96, insufficient buffer in gprsConnection(...) #46

Open
dpmilian opened this issue Dec 10, 2020 · 0 comments
Open

WaspBG96, insufficient buffer in gprsConnection(...) #46

dpmilian opened this issue Dec 10, 2020 · 0 comments

Comments

@dpmilian
Copy link

Currently the WaspBG96::gprsConnection function has a buffer for the commands sent to the BG96 module of 40 bytes:

uint8_t WaspBG96::gprsConnection(char* apn, char* gprsband, char* network, uint8_t operator_type)
{
	uint8_t answer;
	uint8_t status;

	char command_buffer[40];

But the AT command:

// AT+QICSGP=<contextID>[,<context_t ype>,<APN>[,<username>,<passwor d>)[,<authentication>]]]
// "AT+QICSGP=1,1,\"%s\",\"%s\",\"%s\",1\r"
answer = sendCommand(command_buffer, sBG96_OK, sBG96_ERROR_CODE, sBG96_ERROR, 15000);

Can easily overflow the 40 byte size if the APN, username or password parameters are non trivial (10 character length each, for example).
Leads to overwriting stack memory and possible unexpected errors (in my case, overwriting the operator_type variable memory position). The main problem is it's silent nature, without errors.
Possible fix could be increasing this buffer, although some sort of size check, preferably using snprintf_P and checking the string length of the returned values

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant