Skip to content

Commit

Permalink
Corrected out of bounds access coverity warning (ARMmbed#2475)
Browse files Browse the repository at this point in the history 
Corrected out of bounds access coverity warning
  • Loading branch information
Mika Leppänen committed Oct 14, 2020
1 parent 4ffe6a1 commit 8b5b433
Show file tree
Hide file tree
Showing 4 changed files with 59 additions and 41 deletions.
36 changes: 18 additions & 18 deletions source/6LoWPAN/ws/ws_pae_controller.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ static pae_controller_t *ws_pae_controller_get(protocol_interface_info_entry_t *
static void ws_pae_controller_frame_counter_timer(uint16_t seconds, pae_controller_t *entry);
static void ws_pae_controller_frame_counter_timer_trigger(uint16_t seconds, pae_controller_t *entry);
static void ws_pae_controller_frame_counter_store(pae_controller_t *entry, bool use_threshold);
static void ws_pae_controller_nvm_frame_counter_write(nvm_tlv_t *tlv_entry);
static void ws_pae_controller_nvm_frame_counter_write(frame_cnt_nvm_tlv_t *tlv_entry);
static int8_t ws_pae_controller_nvm_frame_counter_read(uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters);
static pae_controller_t *ws_pae_controller_get_or_create(int8_t interface_id);
static void ws_pae_controller_gtk_hash_set(protocol_interface_info_entry_t *interface_ptr, uint8_t *gtkhash);
Expand Down Expand Up @@ -801,8 +801,8 @@ static int8_t ws_pae_controller_frame_counter_read(pae_controller_t *controller)
}
if (updated) {
// Writes incremented frame counters
ws_pae_nvm_store_frame_counter_tlv_create((nvm_tlv_t *) &controller->pae_nvm_buffer, controller->restart_cnt, controller->sec_keys_nw_info.pan_version, &controller->frame_counters);
ws_pae_controller_nvm_frame_counter_write((nvm_tlv_t *) &controller->pae_nvm_buffer);
ws_pae_nvm_store_frame_counter_tlv_create((frame_cnt_nvm_tlv_t *) &controller->pae_nvm_buffer, controller->restart_cnt, controller->sec_keys_nw_info.pan_version, &controller->frame_counters);
ws_pae_controller_nvm_frame_counter_write((frame_cnt_nvm_tlv_t *) &controller->pae_nvm_buffer);
}
}

Expand Down Expand Up @@ -839,28 +839,28 @@ static int8_t ws_pae_controller_nw_info_read(pae_controller_t *controller, sec_p

static int8_t ws_pae_controller_nvm_nw_info_write(protocol_interface_info_entry_t *interface_ptr, uint16_t pan_id, char *network_name, sec_prot_gtk_keys_t *gtks)
{
nvm_tlv_t *tlv = ws_pae_controller_nvm_tlv_get(interface_ptr);
nw_info_nvm_tlv_t *tlv = (nw_info_nvm_tlv_t *) ws_pae_controller_nvm_tlv_get(interface_ptr);
if (!tlv) {
return -1;
}

ws_pae_nvm_store_nw_info_tlv_create(tlv, pan_id, network_name, gtks);

ws_pae_nvm_store_tlv_file_write(NW_INFO_FILE, tlv);
ws_pae_nvm_store_tlv_file_write(NW_INFO_FILE, (nvm_tlv_t *) tlv);

return 0;
}

static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t *interface_ptr, uint16_t *pan_id, char *network_name, sec_prot_gtk_keys_t *gtks)
{
nvm_tlv_t *tlv_entry = ws_pae_controller_nvm_tlv_get(interface_ptr);
nw_info_nvm_tlv_t *tlv_entry = (nw_info_nvm_tlv_t *) ws_pae_controller_nvm_tlv_get(interface_ptr);
if (!tlv_entry) {
return -1;
}

ws_pae_nvm_store_generic_tlv_create(tlv_entry, PAE_NVM_NW_INFO_TAG, PAE_NVM_NW_INFO_LEN);
ws_pae_nvm_store_generic_tlv_create((nvm_tlv_t *) tlv_entry, PAE_NVM_NW_INFO_TAG, PAE_NVM_NW_INFO_LEN);

if (ws_pae_nvm_store_tlv_file_read(NW_INFO_FILE, tlv_entry) < 0) {
if (ws_pae_nvm_store_tlv_file_read(NW_INFO_FILE, (nvm_tlv_t *) tlv_entry) < 0) {
return -1;
}

Expand Down Expand Up @@ -1729,8 +1729,8 @@ static void ws_pae_controller_frame_counter_store(pae_controller_t *entry, bool
if (update_needed || entry->frame_cnt_store_force_timer == 0) {
tr_debug("Write frame counters: system time %"PRIu32"", protocol_core_monotonic_time / 10);
// Writes modified frame counters
ws_pae_nvm_store_frame_counter_tlv_create((nvm_tlv_t *) &entry->pae_nvm_buffer, entry->restart_cnt, entry->sec_keys_nw_info.pan_version, &entry->frame_counters);
ws_pae_controller_nvm_frame_counter_write((nvm_tlv_t *) &entry->pae_nvm_buffer);
ws_pae_nvm_store_frame_counter_tlv_create((frame_cnt_nvm_tlv_t *) &entry->pae_nvm_buffer, entry->restart_cnt, entry->sec_keys_nw_info.pan_version, &entry->frame_counters);
ws_pae_controller_nvm_frame_counter_write((frame_cnt_nvm_tlv_t *) &entry->pae_nvm_buffer);

// Reset force interval when ever values are stored
entry->frame_cnt_store_force_timer = FRAME_COUNTER_STORE_FORCE_INTERVAL;
Expand All @@ -1739,23 +1739,23 @@ static void ws_pae_controller_frame_counter_store(pae_controller_t *entry, bool

static int8_t ws_pae_controller_nvm_frame_counter_read(uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters)
{
nvm_tlv_t *tlv = ws_pae_nvm_store_generic_tlv_allocate_and_create(
PAE_NVM_FRAME_COUNTER_TAG, PAE_NVM_FRAME_COUNTER_LEN);
frame_cnt_nvm_tlv_t *tlv = (frame_cnt_nvm_tlv_t *) ws_pae_nvm_store_generic_tlv_allocate_and_create(
PAE_NVM_FRAME_COUNTER_TAG, PAE_NVM_FRAME_COUNTER_LEN);
if (!tlv) {
return -1;
}

if (ws_pae_nvm_store_tlv_file_read(FRAME_COUNTER_FILE, tlv) < 0) {
ws_pae_nvm_store_generic_tlv_free(tlv);
if (ws_pae_nvm_store_tlv_file_read(FRAME_COUNTER_FILE, (nvm_tlv_t *) tlv) < 0) {
ws_pae_nvm_store_generic_tlv_free((nvm_tlv_t *) tlv);
return -1;
}

if (ws_pae_nvm_store_frame_counter_tlv_read(tlv, restart_cnt, stored_time, pan_version, counters) < 0) {
ws_pae_nvm_store_generic_tlv_free(tlv);
ws_pae_nvm_store_generic_tlv_free((nvm_tlv_t *) tlv);
return -1;
}

ws_pae_nvm_store_generic_tlv_free(tlv);
ws_pae_nvm_store_generic_tlv_free((nvm_tlv_t *) tlv);

return 0;
}
Expand Down Expand Up @@ -1800,9 +1800,9 @@ nvm_tlv_t *ws_pae_controller_nvm_tlv_get(protocol_interface_info_entry_t *interf
return (nvm_tlv_t *) &controller->pae_nvm_buffer;
}

static void ws_pae_controller_nvm_frame_counter_write(nvm_tlv_t *tlv_entry)
static void ws_pae_controller_nvm_frame_counter_write(frame_cnt_nvm_tlv_t *tlv_entry)
{
ws_pae_nvm_store_tlv_file_write(FRAME_COUNTER_FILE, tlv_entry);
ws_pae_nvm_store_tlv_file_write(FRAME_COUNTER_FILE, (nvm_tlv_t *) tlv_entry);

}

Expand Down
24 changes: 12 additions & 12 deletions source/6LoWPAN/ws/ws_pae_nvm_data.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,13 +67,13 @@ void ws_pae_nvm_store_generic_tlv_free(nvm_tlv_t *tlv_entry)
ns_dyn_mem_free(tlv_entry);
}

void ws_pae_nvm_store_nw_info_tlv_create(nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks)
void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks)
{
int len;
tlv_entry->tag = PAE_NVM_NW_INFO_TAG;
tlv_entry->len = PAE_NVM_NW_INFO_LEN;

uint8_t *tlv = ((uint8_t *) &tlv_entry->tag) + NVM_TLV_FIXED_LEN;
uint8_t *tlv = (uint8_t *) &tlv_entry->data[0];

tlv = common_write_16_bit(pan_id, tlv);

Expand Down Expand Up @@ -119,7 +119,7 @@ void ws_pae_nvm_store_nw_info_tlv_create(nvm_tlv_t *tlv_entry, uint16_t pan_id,

}

int8_t ws_pae_nvm_store_nw_info_tlv_read(nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks)
int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks)
{
if (!tlv_entry || !pan_id || !nw_name) {
return -1;
Expand All @@ -129,7 +129,7 @@ int8_t ws_pae_nvm_store_nw_info_tlv_read(nvm_tlv_t *tlv_entry, uint16_t *pan_id,
return -1;
}

uint8_t *tlv = ((uint8_t *) &tlv_entry->tag) + NVM_TLV_FIXED_LEN;
uint8_t *tlv = (uint8_t *) &tlv_entry->data[0];

if (*pan_id == 0xffff) {
// If application has not set pan_id read it from NVM
Expand Down Expand Up @@ -184,12 +184,12 @@ int8_t ws_pae_nvm_store_nw_info_tlv_read(nvm_tlv_t *tlv_entry, uint16_t *pan_id,
return 0;
}

void ws_pae_nvm_store_keys_tlv_create(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys)
void ws_pae_nvm_store_keys_tlv_create(keys_nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys)
{
tlv_entry->tag = PAE_NVM_KEYS_TAG;
tlv_entry->len = PAE_NVM_KEYS_LEN;

uint8_t *tlv = ((uint8_t *) &tlv_entry->tag) + NVM_TLV_FIXED_LEN;
uint8_t *tlv = (uint8_t *) &tlv_entry->data[0];

uint8_t *eui_64 = sec_prot_keys_ptk_eui_64_get(sec_keys);
if (eui_64) {
Expand Down Expand Up @@ -231,7 +231,7 @@ void ws_pae_nvm_store_keys_tlv_create(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec
tr_debug("NVM KEYS write");
}

int8_t ws_pae_nvm_store_keys_tlv_read(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys)
int8_t ws_pae_nvm_store_keys_tlv_read(keys_nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys)
{
if (!tlv_entry || !sec_keys) {
return -1;
Expand All @@ -241,7 +241,7 @@ int8_t ws_pae_nvm_store_keys_tlv_read(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec
return -1;
}

uint8_t *tlv = ((uint8_t *) &tlv_entry->tag) + NVM_TLV_FIXED_LEN;
uint8_t *tlv = (uint8_t *) &tlv_entry->data[0];

// EUI-64 set */
if (*tlv++ == PAE_NVM_FIELD_SET) {
Expand Down Expand Up @@ -281,12 +281,12 @@ int8_t ws_pae_nvm_store_keys_tlv_read(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec
return 0;
}

void ws_pae_nvm_store_frame_counter_tlv_create(nvm_tlv_t *tlv_entry, uint32_t restart_cnt, uint16_t pan_version, frame_counters_t *counters)
void ws_pae_nvm_store_frame_counter_tlv_create(frame_cnt_nvm_tlv_t *tlv_entry, uint32_t restart_cnt, uint16_t pan_version, frame_counters_t *counters)
{
tlv_entry->tag = PAE_NVM_FRAME_COUNTER_TAG;
tlv_entry->len = PAE_NVM_FRAME_COUNTER_LEN;

uint8_t *tlv = ((uint8_t *) &tlv_entry->tag) + NVM_TLV_FIXED_LEN;
uint8_t *tlv = (uint8_t *) &tlv_entry->data[0];

tlv = common_write_32_bit(restart_cnt, tlv);

Expand All @@ -311,7 +311,7 @@ void ws_pae_nvm_store_frame_counter_tlv_create(nvm_tlv_t *tlv_entry, uint32_t re
tr_debug("NVM FRAME COUNTER write");
}

int8_t ws_pae_nvm_store_frame_counter_tlv_read(nvm_tlv_t *tlv_entry, uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters)
int8_t ws_pae_nvm_store_frame_counter_tlv_read(frame_cnt_nvm_tlv_t *tlv_entry, uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters)
{
if (!tlv_entry || !counters) {
return -1;
Expand All @@ -321,7 +321,7 @@ int8_t ws_pae_nvm_store_frame_counter_tlv_read(nvm_tlv_t *tlv_entry, uint32_t *r
return -1;
}

uint8_t *tlv = ((uint8_t *) &tlv_entry->tag) + NVM_TLV_FIXED_LEN;
uint8_t *tlv = (uint8_t *) &tlv_entry->data[0];

*restart_cnt = common_read_32_bit(tlv);
tlv += 4;
Expand Down
30 changes: 24 additions & 6 deletions source/6LoWPAN/ws/ws_pae_nvm_data.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,24 @@
// key storage index bitfield (8)
#define PAE_NVM_KEY_STORAGE_INDEX_LEN 8

typedef struct nw_info_nvm_tlv {
uint16_t tag; /**< Unique tag */
uint16_t len; /**< Number of the bytes after the length field */
uint8_t data[PAE_NVM_NW_INFO_LEN]; /**< Data */
} nw_info_nvm_tlv_t;

typedef struct keys_nvm_tlv {
uint16_t tag; /**< Unique tag */
uint16_t len; /**< Number of the bytes after the length field */
uint8_t data[PAE_NVM_KEYS_LEN]; /**< Data */
} keys_nvm_tlv_t;

typedef struct frame_cnt_nvm_tlv {
uint16_t tag; /**< Unique tag */
uint16_t len; /**< Number of the bytes after the length field */
uint8_t data[PAE_NVM_FRAME_COUNTER_LEN]; /**< Data */
} frame_cnt_nvm_tlv_t;

/**
* ws_pae_nvm_store_generic_tlv_create create NVM generic storage TLV
*
Expand Down Expand Up @@ -77,7 +95,7 @@ void ws_pae_nvm_store_generic_tlv_free(nvm_tlv_t *tlv_entry);
* \return TLV entry or NULL
*
*/
void ws_pae_nvm_store_nw_info_tlv_create(nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks);
void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks);

/**
* ws_pae_nvm_store_nw_info_tlv_read read from NVM network info TLV
Expand All @@ -91,7 +109,7 @@ void ws_pae_nvm_store_nw_info_tlv_create(nvm_tlv_t *tlv_entry, uint16_t pan_id,
* \return >= 0 success
*
*/
int8_t ws_pae_nvm_store_nw_info_tlv_read(nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks);
int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks);

/**
* ws_pae_nvm_store_keys_tlv_create create NVM keys TLV
Expand All @@ -100,7 +118,7 @@ int8_t ws_pae_nvm_store_nw_info_tlv_read(nvm_tlv_t *tlv_entry, uint16_t *pan_id,
* \param sec_keys security keys
*
*/
void ws_pae_nvm_store_keys_tlv_create(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys);
void ws_pae_nvm_store_keys_tlv_create(keys_nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys);

/**
* ws_pae_nvm_store_nw_info_tlv_read read from NVM keys TLV
Expand All @@ -112,7 +130,7 @@ void ws_pae_nvm_store_keys_tlv_create(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec
* \return >= 0 success
*
*/
int8_t ws_pae_nvm_store_keys_tlv_read(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys);
int8_t ws_pae_nvm_store_keys_tlv_read(keys_nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec_keys);

/**
* ws_pae_nvm_store_frame_counter_tlv_create create NVM frame counter TLV
Expand All @@ -123,7 +141,7 @@ int8_t ws_pae_nvm_store_keys_tlv_read(nvm_tlv_t *tlv_entry, sec_prot_keys_t *sec
* \param counters frame counters
*
*/
void ws_pae_nvm_store_frame_counter_tlv_create(nvm_tlv_t *tlv_entry, uint32_t restart_cnt, uint16_t pan_version, frame_counters_t *counters);
void ws_pae_nvm_store_frame_counter_tlv_create(frame_cnt_nvm_tlv_t *tlv_entry, uint32_t restart_cnt, uint16_t pan_version, frame_counters_t *counters);

/**
* ws_pae_nvm_store_frame_counter_tlv_read read from NVM frame counter TLV
Expand All @@ -138,7 +156,7 @@ void ws_pae_nvm_store_frame_counter_tlv_create(nvm_tlv_t *tlv_entry, uint32_t re
* \return >= 0 success
*
*/
int8_t ws_pae_nvm_store_frame_counter_tlv_read(nvm_tlv_t *tlv_entry, uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters);
int8_t ws_pae_nvm_store_frame_counter_tlv_read(frame_cnt_nvm_tlv_t *tlv_entry, uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters);

/**
* ws_pae_nvm_store_key_storage_index_tlv_create create NVM key storage index TLV
Expand Down
10 changes: 5 additions & 5 deletions source/6LoWPAN/ws/ws_pae_supp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -415,25 +415,25 @@ static void ws_pae_supp_nvm_update(pae_supp_t *pae_supp)

static int8_t ws_pae_supp_nvm_keys_write(pae_supp_t *pae_supp)
{
nvm_tlv_t *tlv = ws_pae_controller_nvm_tlv_get(pae_supp->interface_ptr);
keys_nvm_tlv_t *tlv = (keys_nvm_tlv_t *) ws_pae_controller_nvm_tlv_get(pae_supp->interface_ptr);
if (!tlv) {
return -1;
}

ws_pae_nvm_store_keys_tlv_create(tlv, &pae_supp->entry.sec_keys);
ws_pae_nvm_store_tlv_file_write(KEYS_FILE, tlv);
ws_pae_nvm_store_tlv_file_write(KEYS_FILE, (nvm_tlv_t *) tlv);

return 0;
}

static int8_t ws_pae_supp_nvm_keys_read(pae_supp_t *pae_supp)
{
nvm_tlv_t *tlv = ws_pae_controller_nvm_tlv_get(pae_supp->interface_ptr);
keys_nvm_tlv_t *tlv = (keys_nvm_tlv_t *) ws_pae_controller_nvm_tlv_get(pae_supp->interface_ptr);
if (!tlv) {
return -1;
}
ws_pae_nvm_store_generic_tlv_create(tlv, PAE_NVM_KEYS_TAG, PAE_NVM_KEYS_LEN);
if (ws_pae_nvm_store_tlv_file_read(KEYS_FILE_NAME, tlv) < 0) {
ws_pae_nvm_store_generic_tlv_create((nvm_tlv_t *) tlv, PAE_NVM_KEYS_TAG, PAE_NVM_KEYS_LEN);
if (ws_pae_nvm_store_tlv_file_read(KEYS_FILE_NAME, (nvm_tlv_t *) tlv) < 0) {
return -1;
}
ws_pae_nvm_store_keys_tlv_read(tlv, &pae_supp->entry.sec_keys);
Expand Down

0 comments on commit 8b5b433

Please sign in to comment.