[PR] net/oic: bound UUID parser writes [mynewt-core]

["nailongzhanshen666 (via GitHub)" <gi...@apache.org>]

nailongzhanshen666 opened a new pull request, #3845:
URL: https://github.com/apache/mynewt-core/pull/3845

   Fixes #3812
   
   `oc_str_to_uuid()` parsed every non-hyphen character into `oc_uuid_t.id` without bounding the output index, so inputs with more than 32 hex digits could write beyond the 16-byte array. Stop parsing once all UUID bytes have been produced.
   
   Add an OIC selftest covering a canonical UUID and a 34-character input with a guard byte immediately after the UUID.
   
   Validation:
   - The UUID regression test passes in the Mynewt native harness when isolated from network discovery.
   - The full `newt test -q @apache-mynewt-core/net/oic/selftest` builds but times out in the existing `1st discovery` phase; the unmodified upstream commit `9d1e84733468b278123126e24aa850f12f86f3a9` fails identically in this environment.
   - Standalone ASan/UBSan regression harness passes; the unpatched parser overwrites the guard byte.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] net/oic: bound UUID parser writes [mynewt-core]

["sjanc (via GitHub)" <gi...@apache.org>]

sjanc merged PR #3845:
URL: https://github.com/apache/mynewt-core/pull/3845


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org