Mirrors_Framework/rt-thread
1
0
Fork 0
mirror of https://github.com/RT-Thread/rt-thread.git synced 2026-10-01 08:27:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

[net][at] Reject overlong numeric hostnames

Browse Source 
Numeric hostnames were copied into a fixed stack buffer without a length bound.

Cache the length, reject values that cannot fit, and terminate the copy explicitly.

Fixes #11332

Assisted-by: OpenAI Codex:GPT-5
This commit is contained in:
wyf-777
2026-09-21 10:18:56 +08:00
committed by Rbb666
parent 5d1aee9b32
commit 3eff2d5c7e
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/net/at/at_socket/at_socket.c
+11 -3
View File
@@ -1409,6 +1409,7 @@ static int _gethostbyname_by_device(const char *name, ip_addr_t *addr)
struct at_device *device = RT_NULL;
char ipstr[16] = { 0 };
size_t idx = 0;
size_t name_len = 0;
device = at_device_get_first_initialized();
if (device == RT_NULL)
@@ -1421,9 +1422,10 @@ static int _gethostbyname_by_device(const char *name, ip_addr_t *addr)
return -1;
}
for (idx = 0; idx < strlen(name) && !isalpha(name[idx]); idx++);
name_len = strlen(name);
for (idx = 0; idx < name_len && !isalpha((unsigned char)name[idx]); idx++);
if (idx < strlen(name))
if (idx < name_len)
{
if (at_dlock == RT_NULL)
{
@@ -1444,7 +1446,13 @@ static int _gethostbyname_by_device(const char *name, ip_addr_t *addr)
}
else
{
strncpy(ipstr, name, strlen(name));
if (name_len >= sizeof(ipstr))
{
return -1;
}
rt_memcpy(ipstr, name, name_len);
ipstr[name_len] = '\0';
}
#if NETDEV_IPV4 && NETDEV_IPV6