openc3 7.2.1 → 7.4.0

data/data/xtce_schemas/xml.xsd

@@ -0,0 +1,116 @@
+<?xml version='1.0'?>
+<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespace" xmlns:xs="http://www.w3.org/2001/XMLSchema" xml:lang="en">
+
+ <xs:annotation>
+  <xs:documentation>
+   See http://www.w3.org/XML/1998/namespace.html and
+   http://www.w3.org/TR/REC-xml for information about this namespace.
+
+    This schema document describes the XML namespace, in a form
+    suitable for import by other schema documents.  
+
+    Note that local names in this namespace are intended to be defined
+    only by the World Wide Web Consortium or its subgroups.  The
+    following names are currently defined in this namespace and should
+    not be used with conflicting semantics by any Working Group,
+    specification, or document instance:
+
+    base (as an attribute name): denotes an attribute whose value
+         provides a URI to be used as the base for interpreting any
+         relative URIs in the scope of the element on which it
+         appears; its value is inherited.  This name is reserved
+         by virtue of its definition in the XML Base specification.
+
+    lang (as an attribute name): denotes an attribute whose value
+         is a language code for the natural language of the content of
+         any element; its value is inherited.  This name is reserved
+         by virtue of its definition in the XML specification.
+  
+    space (as an attribute name): denotes an attribute whose
+         value is a keyword indicating what whitespace processing
+         discipline is intended for the content of the element; its
+         value is inherited.  This name is reserved by virtue of its
+         definition in the XML specification.
+
+    Father (in any context at all): denotes Jon Bosak, the chair of 
+         the original XML Working Group.  This name is reserved by 
+         the following decision of the W3C XML Plenary and 
+         XML Coordination groups:
+
+             In appreciation for his vision, leadership and dedication
+             the W3C XML Plenary on this 10th day of February, 2000
+             reserves for Jon Bosak in perpetuity the XML name
+             xml:Father
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>This schema defines attributes and an attribute group
+        suitable for use by
+        schemas wishing to allow xml:base, xml:lang or xml:space attributes
+        on elements they define.
+
+        To enable this, such a schema must import this schema
+        for the XML namespace, e.g. as follows:
+        &lt;schema . . .>
+         . . .
+         &lt;import namespace="http://www.w3.org/XML/1998/namespace"
+                    schemaLocation="http://www.w3.org/2001/03/xml.xsd"/>
+
+        Subsequently, qualified reference to any of the attributes
+        or the group defined below will have the desired effect, e.g.
+
+        &lt;type . . .>
+         . . .
+         &lt;attributeGroup ref="xml:specialAttrs"/>
+ 
+         will define a type which will schema-validate an instance
+         element with any of those attributes</xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>In keeping with the XML Schema WG's standard versioning
+   policy, this schema document will persist at
+   http://www.w3.org/2001/03/xml.xsd.
+   At the date of issue it can also be found at
+   http://www.w3.org/2001/xml.xsd.
+   The schema document at that URI may however change in the future,
+   in order to remain compatible with the latest version of XML Schema
+   itself.  In other words, if the XML Schema namespace changes, the version
+   of this document at
+   http://www.w3.org/2001/xml.xsd will change
+   accordingly; the version at
+   http://www.w3.org/2001/03/xml.xsd will not change.
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:attribute name="lang" type="xs:language">
+  <xs:annotation>
+   <xs:documentation>In due course, we should install the relevant ISO 2- and 3-letter
+         codes as the enumerated possible values . . .</xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+
+ <xs:attribute name="space" default="preserve">
+  <xs:simpleType>
+   <xs:restriction base="xs:NCName">
+    <xs:enumeration value="default"/>
+    <xs:enumeration value="preserve"/>
+   </xs:restriction>
+  </xs:simpleType>
+ </xs:attribute>
+
+ <xs:attribute name="base" type="xs:anyURI">
+  <xs:annotation>
+   <xs:documentation>See http://www.w3.org/TR/xmlbase/ for
+                     information about this attribute.</xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+
+ <xs:attributeGroup name="specialAttrs">
+  <xs:attribute ref="xml:base"/>
+  <xs:attribute ref="xml:lang"/>
+  <xs:attribute ref="xml:space"/>
+ </xs:attributeGroup>
+
+</xs:schema>

data/ext/openc3/ext/burst_protocol/burst_protocol.c

@@ -23,6 +23,7 @@ static ID id_method_reduce_to_single_packet = 0;
 static ID id_method_replace = 0;
 static ID id_method_clone = 0;
 static ID id_method_log_discard = 0;
+static ID id_method_check_buffer_size = 0;
 
 static ID id_ivar_data = 0;
 static ID id_ivar_extra = 0;
@@ -77,6 +78,10 @@ static VALUE burst_protocol_read_data(int argc, VALUE *argv, VALUE self)
 
   rb_str_concat(rb_ivar_get(self, id_ivar_data), data);
 
+  /* Bound the memory a peer can make us buffer. Raises if @data has grown
+   * past @max_buffer_size, which makes Interface#read disconnect the peer. */
+  rb_funcall(self, id_method_check_buffer_size, 0);
+
   /* Maintain extra from last read read_data */
   if (!((RSTRING_LEN(data) == 0) && (!(RTEST(extra))))) {
     rb_ivar_set(self, id_ivar_extra, extra);
@@ -301,6 +306,7 @@ void Init_burst_protocol(void)
   id_method_replace = rb_intern("replace");
   id_method_clone = rb_intern("clone");
   id_method_log_discard = rb_intern("log_discard");
+  id_method_check_buffer_size = rb_intern("check_buffer_size");
 
   id_ivar_data = rb_intern("@data");
   id_ivar_extra = rb_intern("@extra");

data/ext/openc3/ext/platform/platform.c

@@ -35,10 +35,13 @@ VALUE cSegFault = Qnil;
 #include <string.h>
 #include <sys/stat.h>
 
+/* Must be a macro rather than a const int so filename below is a fixed size
+ * array rather than a variable length array */
+#define FILENAME_LEN 256
+
 /* Mark that this function does not return (it exits) to remove compiler warning */
 __attribute__((noreturn)) static void catch_sigsegv(int sig_num)
 {
-  const int FILENAME_LEN = 256;
   char *openc3_log_dir = NULL;
   time_t rawtime;
   struct tm timeinfo;

data/ext/openc3/ext/structure/structure.c

@@ -18,6 +18,7 @@
 */
 
 #include "ruby.h"
+#include "stdint.h"
 #include "stdio.h"
 
 #define TO_BIGNUM(x) (FIXNUM_P(x) ? rb_int2big(FIX2LONG(x)) : x)
@@ -400,11 +401,13 @@ static void check_bit_offset_and_size(VALUE self, VALUE type_param, VALUE bit_of
 
   if (bit_offset < 0)
   {
-    bit_offset = ((int)(RSTRING_LEN(buffer_param) * 8) + bit_offset);
-    if (bit_offset < 0)
+    /* Calculate in 64 bits since a large buffer times 8 does not fit in an int */
+    int64_t calculated_bit_offset = (((int64_t)RSTRING_LEN(buffer_param)) * 8) + bit_offset;
+    if ((calculated_bit_offset < 0) || (calculated_bit_offset > INT32_MAX))
     {
       rb_funcall(self, id_method_raise_buffer_error, 5, type_param, buffer_param, data_type_param, bit_offset_param, bit_size_param);
     }
+    bit_offset = (int)calculated_bit_offset;
   }
 
   *new_bit_offset = bit_offset;
@@ -418,23 +421,45 @@ static int even_bit_size(int bit_size)
 
 /* Calculate the bounds of the string to access the item based on the bit_offset and bit_size.
  * Also determine if the buffer size is sufficient. */
-static int check_bounds_and_buffer_size(int bit_offset, int bit_size, int buffer_length, VALUE endianness, VALUE data_type, int *lower_bound, int *upper_bound)
+static int check_bounds_and_buffer_size(int bit_offset, int bit_size, long buffer_length, VALUE endianness, VALUE data_type, int *lower_bound, int *upper_bound)
 {
   int result = 1; /* Assume ok */
-
-  /* Define bounds of string to access this item */
-  *lower_bound = bit_offset / 8;
-  *upper_bound = (bit_offset + bit_size - 1) / 8;
+  int64_t calculated_lower_bound = 0;
+  int64_t calculated_upper_bound = 0;
+
+  /* Calculate in 64 bits so attacker-controlled offsets and sizes cannot
+   * overflow before the buffer bounds are checked. */
+  calculated_lower_bound = ((int64_t)bit_offset) / 8;
+  calculated_upper_bound = (((int64_t)bit_offset) + ((int64_t)bit_size) - 1) / 8;
+  *lower_bound = (int)calculated_lower_bound;
+  *upper_bound = (int)calculated_upper_bound;
+
+  /* The read starts at lower_bound, so it must be checked independently of
+   * upper_bound. Also reject reversed bounds before considering the special
+   * little-endian bitfield case below. */
+  if ((calculated_lower_bound < 0) ||
+      (calculated_lower_bound >= buffer_length) ||
+      (calculated_upper_bound < calculated_lower_bound))
+  {
+    return 0;
+  }
 
   /* Sanity check buffer size */
-  if (*upper_bound >= buffer_length)
+  if (calculated_upper_bound >= buffer_length)
   {
     /* If it's not the special case of little endian bit field then we fail and return 0 */
+    /* Note lower_bound is already known to be inside the buffer */
     if (!((endianness == symbol_LITTLE_ENDIAN) &&
           ((data_type == symbol_INT) || (data_type == symbol_UINT)) &&
           /* Not byte aligned with an even bit size */
-          (!((BYTE_ALIGNED(bit_offset)) && (even_bit_size(bit_size)))) &&
-          (*lower_bound < buffer_length)))
+          (!((BYTE_ALIGNED(bit_offset)) && (even_bit_size(bit_size))))))
+    {
+      result = 0;
+    }
+    /* Little endian bitfields are accessed backwards from bit_offset, so the bytes
+     * they span must all be inside the buffer. Checking this here keeps a huge
+     * bit_size from allocating memory before it is rejected. */
+    else if ((calculated_lower_bound - ((((bit_offset % 8) + ((int64_t)bit_size) - 1) / 8) + 1) + 1) < 0)
     {
       result = 0;
     }
@@ -456,8 +481,8 @@ static int check_bounds_and_buffer_size(int bit_offset, int bit_size, int buffer
 static VALUE binary_accessor_read(VALUE self, VALUE param_bit_offset, VALUE param_bit_size, VALUE param_data_type, VALUE param_buffer, VALUE param_endianness)
 {
   /* Convert Parameters to C Data Types */
-  int bit_offset = FIX2INT(param_bit_offset);
-  int bit_size = FIX2INT(param_bit_size);
+  int bit_offset = NUM2INT(param_bit_offset);
+  int bit_size = NUM2INT(param_bit_size);
 
   /* Local Variables */
   int given_bit_offset = bit_offset;
@@ -502,18 +527,20 @@ static VALUE binary_accessor_read(VALUE self, VALUE param_bit_offset, VALUE para
    * recalculate based on the buffer length */
   if ((bit_size <= 0) && ((param_data_type == symbol_STRING) || (param_data_type == symbol_BLOCK)))
   {
-    bit_size = (((int)buffer_length * 8) - bit_offset + bit_size);
-    if (bit_size == 0)
+    /* Calculate in 64 bits since a large buffer times 8 does not fit in an int */
+    int64_t calculated_bit_size = (((int64_t)buffer_length) * 8) - bit_offset + bit_size;
+    if (calculated_bit_size == 0)
     {
       return rb_str_new2("");
     }
-    else if (bit_size < 0)
+    else if ((calculated_bit_size < 0) || (calculated_bit_size > INT32_MAX))
     {
       rb_funcall(self, id_method_raise_buffer_error, 5, symbol_read, param_buffer, param_data_type, param_bit_offset, param_bit_size);
     }
+    bit_size = (int)calculated_bit_size;
   }
 
-  if (!check_bounds_and_buffer_size(bit_offset, bit_size, (int)buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound))
+  if (!check_bounds_and_buffer_size(bit_offset, bit_size, buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound))
   {
     /* Return nil for out-of-bounds reads (supports undersized packets with ALLOW_SHORT) */
     return Qnil;
@@ -1005,10 +1032,15 @@ static VALUE binary_accessor_write(VALUE self, VALUE value, VALUE param_bit_offs
     {
       value = rb_funcall(value, id_method_to_s, 0);
     }
+    /* Calculate in 64 bits since a large value times 8 does not fit in an int */
+    if ((((int64_t)RSTRING_LEN(value)) * 8) > INT32_MAX)
+    {
+      rb_funcall(self, id_method_raise_buffer_error, 5, symbol_write, param_buffer, param_data_type, param_bit_offset, param_bit_size);
+    }
     bit_size = (int)RSTRING_LEN(value) * 8;
   }
 
-  if ((!check_bounds_and_buffer_size(bit_offset, bit_size, (int)buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound)) && (given_bit_size > 0))
+  if ((!check_bounds_and_buffer_size(bit_offset, bit_size, buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound)) && (given_bit_size > 0))
   {
     rb_funcall(self, id_method_raise_buffer_error, 5, symbol_write, param_buffer, param_data_type, param_bit_offset, param_bit_size);
   }

data/ext/openc3/ext/telemetry/telemetry.c

@@ -56,7 +56,7 @@ static VALUE packets(VALUE self, VALUE target_name)
 
   if (!(RTEST(target_packets)))
   {
-    rb_raise(rb_eRuntimeError, "Telemetry target '%s' does not exist", RSTRING_PTR(upcase_target_name));
+    rb_raise(rb_eRuntimeError, "Telemetry target '%s' does not exist (packets lookup)", RSTRING_PTR(upcase_target_name));
   }
 
   return target_packets;

data/lib/openc3/accessors/binary_accessor.rb

@@ -105,35 +105,70 @@ module OpenC3
     HOST_ENDIANNESS = get_host_endianness()
     # Valid endianness
     ENDIANNESS = [:BIG_ENDIAN, :LITTLE_ENDIAN]
+    NATIVE_INT_MIN = -(2**31)
+    NATIVE_INT_MAX = (2**31) - 1
 
-    def handle_read_variable_bit_size(item, _buffer)
+    def handle_read_variable_bit_size(item, buffer)
       length_value = @packet.read(item.variable_bit_size['length_item_name'], :CONVERTED)
       # length_value can be nil when reading an undersized packet where the length
       # item falls outside the buffer bounds
       raise "Length value #{item.variable_bit_size['length_item_name']} for item #{item.name} is nil" if length_value.nil?
 
       if item.array_size
-        item.array_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
+        array_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
+        validate_variable_bit_size(item, array_size, buffer)
+        item.array_size = array_size
       else
         if item.data_type == :INT or item.data_type == :UINT
           # QUIC encoding is currently assumed for individual variable sized integers
           # see https://datatracker.ietf.org/doc/html/rfc9000#name-variable-length-integer-enc
           case length_value
           when 0
-            item.bit_size = 6
+            bit_size = 6
           when 1
-            item.bit_size = 14
+            bit_size = 14
           when 2
-            item.bit_size = 30
+            bit_size = 30
           else
-            item.bit_size = 62
+            bit_size = 62
           end
         else
-          item.bit_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
+          bit_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
         end
+        validate_variable_bit_size(item, bit_size, buffer)
+        item.bit_size = bit_size
       end
     end
 
+    # A negative bit size is always invalid. A bit size larger than the buffer is
+    # only an error when the packet does not allow short buffers, otherwise the
+    # oversized item simply reads as nil (ALLOW_SHORT).
+    def validate_variable_bit_size(item, bit_size, buffer)
+      available_bit_size = (buffer.length * 8) - item.bit_offset
+      if bit_size < 0 || (!@packet.short_buffer_allowed && (available_bit_size < 0 || bit_size > available_bit_size))
+        raise ArgumentError, "Variable bit size #{bit_size} for item #{item.name} exceeds the #{[available_bit_size, 0].max} bits available in the buffer"
+      end
+    end
+
+    # The native accessor takes C ints, so values outside that range must be
+    # rejected here rather than raising RangeError out of the extension.
+    def native_value_out_of_range?(item)
+      [item.bit_offset, item.bit_size, item.array_size].compact.any? do |value|
+        value < NATIVE_INT_MIN || value > NATIVE_INT_MAX
+      end
+    end
+
+    # Items that derive their size from the buffer (0 or negative bit_size or
+    # array_size) calculate a negative size when the buffer ends before the item
+    # starts. Such an item is simply not present in a short buffer.
+    def derived_size_negative?(item, buffer)
+      available_bit_size = (buffer.length * 8) - item.bit_offset
+      if item.array_size
+        return item.array_size <= 0 && (available_bit_size + item.array_size) < 0
+      end
+      return item.bit_size <= 0 && (available_bit_size + item.bit_size) < 0
+    end
+
     def read_item(item, buffer)
       return nil if item.data_type == :DERIVED
       if item.parent_item
@@ -145,6 +180,9 @@ module OpenC3
         structure.read(item.key, :RAW, structure_buffer)
       else
         handle_read_variable_bit_size(item, buffer) if item.variable_bit_size
+        if @packet.short_buffer_allowed && (native_value_out_of_range?(item) || derived_size_negative?(item, buffer))
+          return nil
+        end
         self.class.read_item(item, buffer)
       end
     end
@@ -288,6 +326,11 @@ module OpenC3
         self.class.write_item(parent_item, structure_buffer, buffer)
       else
         handle_write_variable_bit_size(item, value, buffer) if item.variable_bit_size
+        # Raise the normal buffer error rather than letting the native accessor
+        # raise RangeError when converting the offset or size to a C int
+        if native_value_out_of_range?(item)
+          self.class.raise_buffer_error(:write, buffer, item.data_type, item.bit_offset, item.bit_size)
+        end
         self.class.write_item(item, value, buffer)
       end
     end
@@ -800,16 +843,27 @@ module OpenC3
         lower_bound = bit_offset / 8
         upper_bound = (bit_offset + bit_size - 1) / 8
 
+        # The access starts at lower_bound, so validate it independently rather
+        # than relying on upper_bound to imply that it is safe.
+        if lower_bound < 0 || lower_bound >= buffer_length || upper_bound < lower_bound
+          return false, lower_bound, upper_bound
+        end
+
         # Sanity check buffer size
         if upper_bound >= buffer_length
           # If it's not the special case of little endian bit field then we fail and return false
+          # Note lower_bound is already known to be inside the buffer
           if !((endianness == :LITTLE_ENDIAN) &&
                  ((data_type == :INT) || (data_type == :UINT)) &&
                  # Not byte aligned with an even bit size
-                 (!((byte_aligned(bit_offset)) && (even_bit_size(bit_size)))) &&
-                 (lower_bound < buffer_length)
+                 (!((byte_aligned(bit_offset)) && (even_bit_size(bit_size))))
               )
             result = false
+          # Little endian bitfields are accessed backwards from bit_offset, so the
+          # bytes they span must all be inside the buffer. Checking this here keeps
+          # a huge bit_size from allocating memory before it is rejected.
+          elsif (lower_bound - ((((bit_offset % 8) + bit_size - 1) / 8) + 1) + 1) < 0
+            result = false
           end
         end
         return result, lower_bound, upper_bound

data/lib/openc3/accessors/template_accessor.rb

@@ -109,7 +109,7 @@ module OpenC3
       configure()
 
       success = buffer.gsub!("#{@left_char}#{item.key}#{@right_char}", value.to_s)
-      raise "Key #{item.key} not found in template" unless success
+      raise "Key '#{item.key}' not found in template (write_item)" unless success
       return value
     end
 
@@ -118,7 +118,7 @@ module OpenC3
       items.each_with_index do |item, index|
         next if item.data_type == :DERIVED
         success = buffer.gsub!("#{@left_char}#{item.key}#{@right_char}", values[index].to_s)
-        raise "Key #{item.key} not found in template" unless success
+        raise "Key '#{item.key}' not found in template (write_items)" unless success
       end
       return values
     end

data/lib/openc3/api/cmd_api.rb

@@ -484,7 +484,7 @@ module OpenC3
       user = authorize(permission: 'cmd', target_name: target_name, packet_name: cmd_name, manual: manual, scope: scope, token: token)
       if user.nil?
         user = {}
-        user['username'] = ENV['OPENC3_MICROSERVICE_NAME']
+        user['username'] = ENV.fetch('OPENC3_MICROSERVICE_NAME', nil)
 
         # Get the caller stack trace to determine the point in the code where the command was called
         # This code works but ultimately we didn't want to overload 'username' and take a performance hit

data/lib/openc3/api/interface_api.rb

@@ -47,7 +47,7 @@ module OpenC3
     def get_interface(interface_name, manual: false, scope: $openc3_scope, token: $openc3_token)
       authorize(permission: 'system', interface_name: interface_name, manual: manual, scope: scope, token: token)
       interface = InterfaceModel.get(name: interface_name, scope: scope)
-      raise "Interface '#{interface_name}' does not exist" unless interface
+      raise "Interface '#{interface_name}' does not exist (get_interface)" unless interface
 
       interface.merge(InterfaceStatusModel.get(name: interface_name, scope: scope))
     end
@@ -160,7 +160,7 @@ module OpenC3
       # TODO: Check if they have command authority for the targets mapped to this interface
       authorize(permission: 'system_set', interface_name: interface_name, manual: manual, scope: scope, token: token)
       interface = InterfaceModel.get_model(name: interface_name, scope: scope)
-      raise "Interface '#{interface_name}' does not exist" unless interface
+      raise "Interface '#{interface_name}' does not exist (unmap_target_from_interface)" unless interface
 
       if Array === target_name
         target_names = target_name