Skip to content

Commit

Permalink
Set a recursion depth limit for TLV (#26301)
Browse files Browse the repository at this point in the history
* Set a recursion depth limit for TLV

* Restyled by clang-format

* Restyled by prettier-markdown

---------

Co-authored-by: Andrei Litvin <[email protected]>
Co-authored-by: Restyled.io <[email protected]>
  • Loading branch information
3 people authored and pull[bot] committed Jun 26, 2023
1 parent a672f77 commit 1587612
Show file tree
Hide file tree
Showing 5 changed files with 22 additions and 1 deletion.
1 change: 1 addition & 0 deletions docs/ERROR_CODES.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ This file was **AUTOMATICALLY** generated by
| 2 | 0x02 | `CHIP_ERROR_CONNECTION_ABORTED` |
| 3 | 0x03 | `CHIP_ERROR_INCORRECT_STATE` |
| 4 | 0x04 | `CHIP_ERROR_MESSAGE_TOO_LONG` |
| 5 | 0x05 | `CHIP_ERROR_RECURSION_DEPTH_LIMIT` |
| 6 | 0x06 | `CHIP_ERROR_TOO_MANY_UNSOLICITED_MESSAGE_HANDLERS` |
| 7 | 0x07 | `CHIP_ERROR_NO_UNSOLICITED_MESSAGE_HANDLER` |
| 8 | 0x08 | `CHIP_ERROR_NO_CONNECTION_HANDLER` |
Expand Down
3 changes: 3 additions & 0 deletions src/lib/core/CHIPError.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,9 @@ bool FormatCHIPError(char * buf, uint16_t bufSize, CHIP_ERROR err)
case CHIP_ERROR_MESSAGE_TOO_LONG.AsInteger():
desc = "Message too long";
break;
case CHIP_ERROR_RECURSION_DEPTH_LIMIT.AsInteger():
desc = "Recursion depth limit reached";
break;
case CHIP_ERROR_TOO_MANY_UNSOLICITED_MESSAGE_HANDLERS.AsInteger():
desc = "Too many unsolicited message handlers";
break;
Expand Down
5 changes: 4 additions & 1 deletion src/lib/core/CHIPError.h
Original file line number Diff line number Diff line change
Expand Up @@ -466,7 +466,10 @@ using CHIP_ERROR = ::chip::ChipError;
*/
#define CHIP_ERROR_MESSAGE_TOO_LONG CHIP_CORE_ERROR(0x04)

// AVAILABLE: 0x05
/**
* Recursion depth overflow
*/
#define CHIP_ERROR_RECURSION_DEPTH_LIMIT CHIP_CORE_ERROR(0x05)

/**
* @def CHIP_ERROR_TOO_MANY_UNSOLICITED_MESSAGE_HANDLERS
Expand Down
13 changes: 13 additions & 0 deletions src/lib/core/TLVUtilities.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,14 @@ namespace TLV {

namespace Utilities {

namespace {

// Sets up a limit on recursion depth, to avoid any stack overflows
// on very deep TLV structures. Embedded has limited stack space.
constexpr size_t kMaxRecursionDepth = 10;

} // namespace

struct FindContext
{
const Tag & mTag;
Expand Down Expand Up @@ -63,6 +71,11 @@ static CHIP_ERROR Iterate(TLVReader & aReader, size_t aDepth, IterateHandler aHa
{
CHIP_ERROR retval = CHIP_NO_ERROR;

if (aDepth >= kMaxRecursionDepth)
{
return CHIP_ERROR_RECURSION_DEPTH_LIMIT;
}

if (aReader.GetType() == kTLVType_NotSpecified)
{
ReturnErrorOnFailure(aReader.Next());
Expand Down
1 change: 1 addition & 0 deletions src/lib/core/tests/TestCHIPErrorStr.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ static const CHIP_ERROR kTestElements[] =
CHIP_ERROR_CONNECTION_ABORTED,
CHIP_ERROR_INCORRECT_STATE,
CHIP_ERROR_MESSAGE_TOO_LONG,
CHIP_ERROR_RECURSION_DEPTH_LIMIT,
CHIP_ERROR_TOO_MANY_UNSOLICITED_MESSAGE_HANDLERS,
CHIP_ERROR_NO_UNSOLICITED_MESSAGE_HANDLER,
CHIP_ERROR_NO_CONNECTION_HANDLER,
Expand Down

0 comments on commit 1587612

Please sign in to comment.