vintlabs / fauxmoESP

Add voice control of your ESP32 and ESP8266 devices using Amazon Alexa
MIT License
384 stars 69 forks source link

Indexing past end of `data` in _onUDPData(...) to write zero terminator #49

Closed pvint closed 5 years ago

pvint commented 6 years ago

Original report by M Hightower (Bitbucket: mhightower83, GitHub: mhightower83).


I think these lines in _onUDPData() are writing past the memory allocation that was made back in handle():

void fauxmoESP::_onUDPData(IPAddress remoteIP, unsigned int remotePort, void *data, size_t len) {
  ...
    char * p = (char *) data;
    p[len] = 0;

In handle() it was allocated and passed through like this:

void fauxmoESP::handle() {
  ...
    uint8_t data[len];
    _udp.read(data, len);
    _onUDPData(remoteIP, remotePort, data, len);

No allowance in size was made to hold an extra byte for zero termination.

pvint commented 5 years ago

Original comment by Xose Pérez (Bitbucket: [Xose Pérez](https://bitbucket.org/Xose Pérez), ).


Indeed. It was fixed some time ago. Now data is declared as unsigned char data[len+1];.