Skip to content

Commit d6e90f5

Browse files
committed
Handle errors in cbor_value_advance
Fixes infinite loops on input like unsigned char buf[] = {0x81, 0xff, 0xA2, 0x61, 0x6E, 0x64, 0x74, 0x65, 0x73, 0x74, 0x61, 0x76, 0x7, 0x0}; thing.decode((uint8_t*)buf, sizeof(buf));
1 parent c79748b commit d6e90f5

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

ArduinoCloudThing.cpp

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -200,14 +200,20 @@ void ArduinoCloudThing::decode(uint8_t * payload, size_t length) {
200200
CborType type = cbor_value_get_type(&recursedMap);
201201
if (type != CborMapType) {
202202
// stop the decode when 1st item thai is not a cbor map is found.
203-
cbor_value_advance(&dataArray);
203+
CborError err = cbor_value_advance(&dataArray);
204+
if (err != CborNoError) {
205+
break;
206+
}
204207
continue;
205208
} else {
206209

207210
while (!cbor_value_at_end(&recursedMap)) {
208211
// if the current element is not a cbor object as expected, skip it and go ahead.
209212
if (cbor_value_get_type(&recursedMap) != CborMapType) {
210-
cbor_value_advance(&recursedMap);
213+
CborError err = cbor_value_advance(&recursedMap);
214+
if (err != CborNoError) {
215+
break;
216+
}
211217
continue;
212218
}
213219

0 commit comments

Comments
 (0)