SHA2017-badge / Firmware

ESP32 firmware for the SHA2017 badge
https://wiki.sha2017.org/w/Badge
Other
83 stars 36 forks source link

bpp-recv/defec.c: null-pointer deref in defecInit() #198

Open pesco opened 7 years ago

pesco commented 7 years ago

if defecInit is called after defecRecv processed a parameter packet (serial=0) that specifies an invalid decoder algorithm, the parameters are already in savedStatus so a subsequent defecInit will attempt to restore the decoder but yield NULL, leading to a crash in

      currDecoder->init(currK, currN, maxLen);

this can happen if an invalid parameter packet is received before the system enters deep sleep (-> defecInit after wakeup).

likewise, if the decoder parameters (k/n) are invalid, the unchecked call above will fail and subsequent decoder calls will access uninitialized memory or reuse stale values.