Skip to content

buffer overflow in function setLedKey #58

Description

@xidoo123

Description

In function setLedKey, it fails to check col properly

static inline void setLedKey(led_t *ledArray, const message_t *msg) {
  uint8_t row = msg->payload[0];
  uint8_t col = msg->payload[1];
  led_t color = {.p.blue = msg->payload[2],
                 .p.green = msg->payload[3],
                 .p.red = msg->payload[4],
                 .p.alpha = msg->payload[5]};
  naiveDimLed(&color);
  if (row < NUM_ROW && col <= NUM_COLUMN)   <--- oob 
    setKeyColor(&ledArray[ROWCOL2IDX(row, col)], color.rgb);
}

This leads to data corruption when setKeyColor trying to write ledArray at an out-of-bound offset, potentially causing DoS/RCE.

Fix

change col <= NUM_COLUMN to col < NUM_COLUMN

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions