You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by ja...@apache.org on 2026/10/26 12:38:48 UTC
(mynewt-core) 02/07: net/lora: Validate channel id when removing channel
This is an automated email from the ASF dual-hosted git repository.
sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
commit b0578836e0c7e2b02e955e90647c34f60268e628
Author: Szymon Janc <sz...@codecoup.pl>
AuthorDate: Sun Oct 25 21:58:59 2026 +0100
net/lora: Validate channel id when removing channel
Channel was cleared before RegionCommonChanDisable() checked channel
id, so NewChannelReq MAC command with frequency 0 and channel id out
of range resulted in out of bounds write past Channels array.
Check channel id before clearing the channel.
Assisted-by: Claude:claude-opus-5-5
---
net/lora/node/src/mac/region/RegionAS923.c | 2 +-
net/lora/node/src/mac/region/RegionCN779.c | 2 +-
net/lora/node/src/mac/region/RegionEU433.c | 2 +-
net/lora/node/src/mac/region/RegionEU868.c | 2 +-
net/lora/node/src/mac/region/RegionIN865.c | 2 +-
net/lora/node/src/mac/region/RegionKR920.c | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/lora/node/src/mac/region/RegionAS923.c b/net/lora/node/src/mac/region/RegionAS923.c
index 692238685..6ef4df7e7 100644
--- a/net/lora/node/src/mac/region/RegionAS923.c
+++ b/net/lora/node/src/mac/region/RegionAS923.c
@@ -1056,7 +1056,7 @@ bool RegionAS923ChannelsRemove( ChannelRemoveParams_t* channelRemove )
{
uint8_t id = channelRemove->ChannelId;
- if( id < AS923_NUMB_DEFAULT_CHANNELS )
+ if( ( id < AS923_NUMB_DEFAULT_CHANNELS ) || ( id >= AS923_MAX_NB_CHANNELS ) )
{
return false;
}
diff --git a/net/lora/node/src/mac/region/RegionCN779.c b/net/lora/node/src/mac/region/RegionCN779.c
index 1cac51778..dfdb9edea 100644
--- a/net/lora/node/src/mac/region/RegionCN779.c
+++ b/net/lora/node/src/mac/region/RegionCN779.c
@@ -979,7 +979,7 @@ bool RegionCN779ChannelsRemove( ChannelRemoveParams_t* channelRemove )
{
uint8_t id = channelRemove->ChannelId;
- if( id < CN779_NUMB_DEFAULT_CHANNELS )
+ if( ( id < CN779_NUMB_DEFAULT_CHANNELS ) || ( id >= CN779_MAX_NB_CHANNELS ) )
{
return false;
}
diff --git a/net/lora/node/src/mac/region/RegionEU433.c b/net/lora/node/src/mac/region/RegionEU433.c
index 6f2f4ec0e..793039033 100644
--- a/net/lora/node/src/mac/region/RegionEU433.c
+++ b/net/lora/node/src/mac/region/RegionEU433.c
@@ -979,7 +979,7 @@ bool RegionEU433ChannelsRemove( ChannelRemoveParams_t* channelRemove )
{
uint8_t id = channelRemove->ChannelId;
- if( id < EU433_NUMB_DEFAULT_CHANNELS )
+ if( ( id < EU433_NUMB_DEFAULT_CHANNELS ) || ( id >= EU433_MAX_NB_CHANNELS ) )
{
return false;
}
diff --git a/net/lora/node/src/mac/region/RegionEU868.c b/net/lora/node/src/mac/region/RegionEU868.c
index c61d10436..d972ab884 100644
--- a/net/lora/node/src/mac/region/RegionEU868.c
+++ b/net/lora/node/src/mac/region/RegionEU868.c
@@ -1016,7 +1016,7 @@ bool RegionEU868ChannelsRemove( ChannelRemoveParams_t* channelRemove )
{
uint8_t id = channelRemove->ChannelId;
- if( id < EU868_NUMB_DEFAULT_CHANNELS )
+ if( ( id < EU868_NUMB_DEFAULT_CHANNELS ) || ( id >= EU868_MAX_NB_CHANNELS ) )
{
return false;
}
diff --git a/net/lora/node/src/mac/region/RegionIN865.c b/net/lora/node/src/mac/region/RegionIN865.c
index 8a438227a..00a85bc00 100644
--- a/net/lora/node/src/mac/region/RegionIN865.c
+++ b/net/lora/node/src/mac/region/RegionIN865.c
@@ -1004,7 +1004,7 @@ bool RegionIN865ChannelsRemove( ChannelRemoveParams_t* channelRemove )
{
uint8_t id = channelRemove->ChannelId;
- if( id < IN865_NUMB_DEFAULT_CHANNELS )
+ if( ( id < IN865_NUMB_DEFAULT_CHANNELS ) || ( id >= IN865_MAX_NB_CHANNELS ) )
{
return false;
}
diff --git a/net/lora/node/src/mac/region/RegionKR920.c b/net/lora/node/src/mac/region/RegionKR920.c
index d4587cab0..7cb4dabae 100644
--- a/net/lora/node/src/mac/region/RegionKR920.c
+++ b/net/lora/node/src/mac/region/RegionKR920.c
@@ -975,7 +975,7 @@ bool RegionKR920ChannelsRemove( ChannelRemoveParams_t* channelRemove )
{
uint8_t id = channelRemove->ChannelId;
- if( id < KR920_NUMB_DEFAULT_CHANNELS )
+ if( ( id < KR920_NUMB_DEFAULT_CHANNELS ) || ( id >= KR920_MAX_NB_CHANNELS ) )
{
return false;
}