fix(zwave_rx): Harden zwave_rx_zwapi_callbacks.c

rzr · rzr · commit 7dc10cda90f5 · 2025-09-16T15:42:52.000+02:00
Add extra check to prevent small buffers attacks.

Bug-SiliconLabs: UIC-3672
Relate-to: SLVDBBP-3169959
Signed-off-by: Philippe Coval &lt;philippe.coval@silabs.com&gt;
diff --git a/applications/zpc/components/zwave/zwave_rx/src/zwave_rx_zwapi_callbacks.c b/applications/zpc/components/zwave/zwave_rx/src/zwave_rx_zwapi_callbacks.c
@@ -206,8 +206,11 @@ static void
                                 uint8_t zwapi_zwave_nif_length,
                                 zwave_node_info_t *destination_node_info)
 {
+  static const int header_offset = 3;
   if (zwapi_zwave_nif == NULL || destination_node_info == NULL
-      || zwapi_zwave_nif_length == 0) {
+      || zwapi_zwave_nif_length == 0
+      || zwapi_zwave_nif_length <= header_offset // For zwave_command_class_list_unpack
+  ) {
     return;
   }
 
@@ -239,7 +242,7 @@ static void
 
   zwave_command_class_list_unpack(destination_node_info,
                                   &zwapi_zwave_nif[index],
-                                  zwapi_zwave_nif_length - 3);
+                                  zwapi_zwave_nif_length - header_offset);
 }
 
 void zwave_rx_poll_request()

Original file line number	Diff line number	Diff line change
`@@ -206,8 +206,11 @@ static void`
`206`	`206`	`uint8_t zwapi_zwave_nif_length,`
`207`	`207`	`zwave_node_info_t *destination_node_info)`
`208`	`208`	`{`
	`209`	`+ static const int header_offset = 3;`
`209`	`210`	`if (zwapi_zwave_nif == NULL \|\| destination_node_info == NULL`
`210`		`- \|\| zwapi_zwave_nif_length == 0) {`
	`211`	`+ \|\| zwapi_zwave_nif_length == 0`
	`212`	`+ \|\| zwapi_zwave_nif_length <= header_offset // For zwave_command_class_list_unpack`
	`213`	`+ ) {`
`211`	`214`	`return;`
`212`	`215`	`}`
`213`	`216`
`@@ -239,7 +242,7 @@ static void`
`239`	`242`
`240`	`243`	`zwave_command_class_list_unpack(destination_node_info,`
`241`	`244`	`&zwapi_zwave_nif[index],`
`242`		`- zwapi_zwave_nif_length - 3);`
	`245`	`+ zwapi_zwave_nif_length - header_offset);`
`243`	`246`	`}`
`244`	`247`
`245`	`248`	`void zwave_rx_poll_request()`